I disagree, an app should always check permissions on startup and request any that it needs, in case the user has removed those permissions on their own.
The only benefit I see of the all-at-startup solution is that it provides one single "interruption" to the user. But the list of things an app might do can be large, even though it only may need to do some of them rarely. So if I see a big long scary list I'm more likely to just cancel out.