That research was conducted on the 2018 version of the OS, and also at a time when Google Play's distribution agreement was much more relaxed (close to zero app checks).

As far as I know, most (if not all) of the concerns shared have been addressed in the following 2 years, so I would assume that this is not an issue anymore in 2023 - or at least not as severe. I believe that new loopholes exist, but this one seems outdated to me.

The data described in that article (Eg MAC Address) has virtually zero overlap with the kind of data GP mentioned (contact list, gallery). Most people only care about the latter.

btw "The researchers discovered that the Shutterfly app was accessing the location tags of photos' EXIF metadata. All that's required is the READ_EXTERNAL_STORAGE permission" sounds ridiculous. If you grant permission to read entire files, of course the app can read metadata.