Perhaps a more pressing issue is the similarity of any particular coin's characteristics with the wide variety of foreign coins available (numismatic birthday attack)
They blindly click on ACCEPT because Google stupidly lists relatively benign permissions ("network access", "read phone state", "vibrate") where they should be only listing severe ones. And the permissions they do list are often poorly explained.