The engineer at Facebook wants to be able to send the phone a message so as to authenticate the validity of a phone number. She writes an Android app to do this. To get the text messages, she has to request the READ_SMS permission, so she does.
Meanwhile, the lawyers at Facebook are paid to protect the company from unnecessary liability. They decide to write a ToS that says they can do anything; that way, if they do something you don't like, you can't sue them, thus protecting the company from liability.
Later, some other engineer comes along and puts these two pieces of information together. READ_SMS!? They can do anything they want!? They must be up to something shady!
Turns out: nope! Just a miscommunication.
The real innovation in our field that I hope to see in the next few years is the right balance among the following concerns:
* Ease of use, even among non-technical users.
* Security from malicious applications / extensions / apps / etc.
* The service provider's desire to not be sued.
* The user's desire to not have his privacy violated.
If you give everything fine-grained permissions, you'll have to be a software engineer to understand how to use the application. If you don't have any permissions, every Flappy Bird clone will subscribe you to paid SMS services. If the service provider claims to be liable for privacy breaches that they didn't intend, then they'll have to prove, in court, at great cost, that they're not to blame, every time any of their billion users complains. If the service provider claims to be able to do anything, the user will assume that they're reading all of his email to pick stocks and get some good info for stealing his girlfriend.
So it's clear that the extremes don't work. What we need to find is what does work. This write-up shows how one non-extreme balance doesn't work. Let's find another one and try again!