Well, there's a lot of questions in one. Let's handle a few:
If your concern is major applications, such as Facebook, Twitter, etc., from major publishers and services, then as long as you're downloading updates from the Play Store, there's no reason to assume you're downloading a possible malicious application. The apps are all digitally signed and scanned by Google. While malware HAS gotten onto the Play Store, it doesn't get on there as updates to major, legitimate apps. It ends up on there as its own unique app from shady publishers, or updates to apps that got sold to a new publisher, etc. If a major app like Twitter or Facebook wants a new permission, you can feel confident it's for a feature and not malicious.
What that doesn't tell you is whether or not you're comfortable feeling paranoid about how that major publisher intends to use that permission. Some people strongly distrust Facebook, and are unwilling to hand those sorts of permissions to them, even though the app isn't strictly malicious, as it's the company they have an issue with. That's more of a personal judgment call than anything else.
The other priority is to familiarize yourself with what the permissions actually mean (here's a good place to do that from Google), and get a basic understanding of how apps actually function. Some sound scary until you understand why they're necessary. An example was someone I found upset over a keyboard app requiring permission to monitor everything they type, oblivious to the fact that without that permission, it couldn't function as a keyboard. Understanding how apps need to communicate over the network, or be aware of incoming call status in order to pause a game, or being able to review contacts in order to try to suggest new friends based on people you know, or needing access to the camera because they can take photo notes or do video chat, etc., will help you parse which permissions fit within the mission of the app and which ones seem like a stretch to possible data-mining. Google's descriptions tend to focus on the worst-possible scenarios because they have to allow for them. But dialing back and recognizing that, yes, this permission does allow for scenario Z, but it's also the only way they can do scenario A, which is right in line with the goal of the app, will help you figure out when you're being a little paranoid.