who's fault is it then, if not the OS? that's basically the os's job; to isolate and manage the system's resources and access to them therin
At the direction of the device owner, though.
the malicious app, even signed off the app store could also exploit unpublished vulnerabilities to gain elevated access and not require asking for permission. even or especially if it's not a full sandbox escape.