I honestly don't understand why this is a problem. Isn't it enough that the app says it requires my location when I install it?
If you don't like the required permissions no one is forcing you to install it.
On iOS, the average user has a chance to download that mainstream app and deny it access to their contacts.
That sounds like you meant it as a rhetorical question, but "yes" is a reasonable answer.
> are [most people] really going to forgo having Facebook [...]
There will certainly always be people who do pay attention to permissions for privacy or security reasons, but they seem* vastly outnumbered by the people who don't.
* Just an intuitive sense, I have not looked for data to back this up.
Also, the development cost of 'does this feature exist?' for each permission is pretty high.
Then Facebook Lite came out, and it was what I wanted all along.
Where before it listed each permission, and required a manual approval of any was added in a app update, it now only list categories.
And it will only require manual approval if a new category is added.
And the categories are wide enough that someone can add an innocuous permission initially, and then push a update some time later that gives them virtually free reign of the user data.