Well.. fine. Android is supposed to offer some knowledge of what an application is doing with its permissions management. An application asks for the permissions that it needs.
However, there needs to be finer grained control for that to make sense (as some seemingly non-relevant permissions get lumped into "requires internet access").. which undermines the whole system if (for example... a false example) say that reading the phones contact list returns as a permisison set "full access to read/write contact details".. even if the application is just reading them.. do you really think that's giving enough information.
I understand because Android is open that the engineers needed to set some restrictions, but when the conditions to trigger a set of permissions is so loose.. you have that syndrome that 99.99% of computer users have of saying "yes, whatever.. just go away and let me do what I want!" which isn't conducive to people making decisions (hence why spyware gets installed. Virus writers don't need to deal with any exploits really anymore, they just wait for the user to install it manually.