It's much the same problem as (among other examples) mobile device permissions.
Things have improved somewhat, but for years every Android app asked for permissions like "view and edit the files on your device". 99% of the time that was innocuous. Saving a single user setting could require creating and viewing a file. It's easy to see why devs with no good alternative would have been frustrated to hear "hey, why do you want permission to see all my stuff?!" But that didn't make it good or secure. Flashlight apps would get file permissions to save a single setting, then hoover up as much data as they could get with that permission.
The problem was precisely that the innocent, 'right' way of using permissions was potentially a channel for abuse. If people object that loading a single font from Typekit is inherently a violation of privacy, maybe they're fundamentalists. But in practice, what I see people point out is that it creates a threat to privacy, that the entire ecosystem of data access in inseparable from the ecosystem of tracking and advertising. And that's absolutely true.
On Windows there is a modern app model (UWP) that provides for app isolation and more granular permissions but the push to get software moved over to it seems to have stalled.
There is/was a long-standing bug on Android that as far as I can tell Google never completely fixed (though I might be wrong). For apps that have both an .APK and .OBB file, the Play Store would save the .OBB file to the user's device with the incorrect file owner. This would cause the app to fail (or at least the app wouldn't see the .OBB file already there and would, I think, re-download it). The workaround involved requiring the app developer to ask for this permission, even though their actual app didn't need it, in order to avoid this issue. ANother workaround was to ask users to reboot their phone, since (I think) the permission would be corrected after a reboot (not sure, didn't delve too deeply into that in particular).
For those that are unfamiliar - .APK files are the application packages and they're limited in size by the Google Play Store. To get around the size limit, developers can create a larger .OBB file that they could host on Play (I think?) but then have to download. Google then implemented automatic downloading of the .OBB file by the Play Store, but as far as I can tell never got it right. The whole thing seems to be getting superceded by a new format called AAB (Android Application Bundle).
See: https://issuetracker.google.com/issues/37544273
Followed by: https://issuetracker.google.com/issues/37075181
For some context: https://forum.unity.com/threads/android-app-bundle-how-to-up...