Consider potentially lots of:
if session.gps: show_ads(location) else: show_ads(general)
--
but for every feature of the application that could be using extended permissions.
--
This flashlight app is a bad example, and I'm not saying this is an excuse, but I think this is the rationale that is generally used.