Couple of things.

iOS is sandboxed so they can’t do anything outside of the context of that app. To use any APIs that would require a permission dialogue you have to make a request to get a handle on them which only happens after a user grants permission, you can’t just reach into these. This is baked into the OS. Apps like the ones you’re talking about already hoover up is much data as possible in this context.

iOS itself is actually really good at this and can be improved and hardened further, Apple wants you to believe it’s somehow their review process and strict distribution channel that makes this possible.