+1 for freezing unused apps. Would lower the attack surface nicely!
If you give SuperFreezZ App stopper permissions (it needs to be registered as an accessibility service, and requires usage access as well) to check for usage of applications, then it will freeze unused applications automatically. You can even specify after how many days of not having used them you want to freeze them.
Requests for access to files, location, mic, and camera usually give me the option of allowing them all of the time or only when the app is open.
I've also noticed system notifications stating that permissions will be used from unused apps.
Greater configurability is always nice though.