The Developer documentation writes on the protection level "signature":
A permission that the system grants only if the requesting application is signed with the same certificate as the application that declared the permission. If the certificates match, the system automatically grants the permission without notifying the user or asking for the user's explicit approval.
This was as I always knew it. But it seems to somehow contradict what the same documentation writes about WRITE_SETTINGS, which is marked as "Protection level: signature":
If the app targets API level 23 or higher, the app user must explicitly grant this permission to the app through a permission management screen.
Does that mean the behavior towards this has changed with Marshmallow – and a non-system app using a different signature can still access functionality covered by it, provided the user agrees? Also, with the new "mentality" of automatically granting permissions of a group where the user already has another permission granted: is this permission also granted automatically then (like with all permissions of the protection level "dangerous") – or is the difference here that it always requires the user's agreement, no matter what?
Note 1: there were a lot of changes towards how permissions are dealt with in Android 6+. To not make a "too broad" question, I've tried to split it up; so for the other parts, please also see: Permission system changes with Android 6.0: What are the implications for us users? and Android 6+ and account permissions: where have they gone to?
Note 2: This definitely is of relevance to the end user, as it's about his/her data – and cross-checking permissions for possible implications should be part of the installation or rather app selection process. I'm not asking from the perspective of a developer on how to deal with that when writing an app (though that might be interesting at well ;)