This is a problem with android/ios or the app development process entirely. If permissions could be requested on demand within an app after installation, the the initial permissions sought won't be as intrusive. For PayPal, thier userbase is quite large, and because you don't use a feature, doesn't mean a million users elsewhere don't.
So, imo, the apps permission handling is to blame here