I was reading this answer, and the first comment under it, and wondered if apps can bypass their own app permissions and just get whatever data they want from Google Play Services.
What got me started with this was when I removed a bunch of permissions from Google Play Services and I started getting a notification saying "Accupedo is having trouble with Google Play Services. Try again." Clicking this notification brings up a screen saying "This app won't work properly unless you allow Google Play Services' request to access the following: Calendar; Camera; Contacts; Microphone; Phone; SMS. To Continue, open Settings, then Permissions, and allow all listed items."
As I search on the web and this site, I see everyone, seemingly blindly, saying "Oh, just give Google Play Services all the permissions possible and don't question them." But why? The whole point of having control over app permissions is to have control. This advice is simply giving up and letting Google do whatever they want.
As a concrete example, this one app does not request app permissions to my contacts, microphone, sms, camera, etc. However, Google Play Services' notification makes me think that this app is trying to get my SMS and camera and microphone. Since a simple step-counting app has zero reason to know my contacts or have access to my mic or camera, I would really like to know if they are trying to bypass even requesting app permissions and just getting everything they want from Google Play Services. If this is not the case, why would Google Play Services be sending me this notice?
By the way, originally, it included in the Google Play Services notification's permission list "body sensors." Since this made sense for a step-counting app, I went to Google Play Services and turned on that one permission. Now, "body sensors" is no longer in the list. This lends support to my idea that Google Play Services is receiving a request specifically for access to my camera and microphone (and others) from Accupedo while Accupedo has no such permission requested in the app permissions.
To be clear, this post is not about Accupedo. This question is about whether or not apps in general can simply hide from the user that they are collecting certain data or accessing certain parts of my phone without my awareness by getting everything from Google Play Services.
Any insights would be greatly welcomed.