Sometimes I shudder to think of a future where websites would render some server-generated image version of their website (think Flash) so that users couldn't possibly dare to change the experience of their website from the corporate-approved one.
And with the app comes the tracking and stealing of personal information, often using more or less dark patterns to trick the user.
From what I understand, an app that has no rights to pictures, contacts and location and so on, can still get info about the WIFI and put together a pretty good picture of your movements.
I don't have a citation for this, but it's pretty clear that they do this to make automation harder.
On both iOS and Android, an app can access connected wifi even with location disabled.