Is there any particular reason these kinds of APIs are not behind permission prompts?