> Under this model, the app is completely isolated by default, and never knows how many permissions the user has granted it, so it never knows whether or not to ask for more of them.

This model has benefits, but it also has a major downside: if the app doesn't know it doesn't have privileges, it can't inform the user of that fact. The user has to realize on their own that the reason their search for a local bakery returned something on the other side of the country is that they forgot to enable location permissions.