Neither big players have refined enough permissions. These set users up for giving away more data than they think.

Maybe one clear example is needing a permission once for setup and then it remaining persistent.

An easy demonstration is just looking at what Graphene has done. It's open source and you wana say Google can't protect their users better? Certainly Graphene has some advanced features but not everything can be dismissed so easily. Besides, just throw advanced features behind a hidden menu (which they already have!). There's no reason you can't many most users happy while also catering to power users (they'll always complain, but that's their job)

https://grapheneos.org/features