Maybe "lazy" is the best word, but moving from Android's classic "grant permissions on install" to "prompt for permission" is a major change that they spent a long time working on (I think Android 4 already had a lot of the backend for this?).
It's not like it was secretly granting permissions to apps, and you could always choose to not install something that took too many permissions.
You could say they made the wrong choice, but we're a long way from "this binary can do everything on your files" model of Unices/Windows