Typically, the app needs to ask for permissions like that, though. On Android, they need to ask to become a "Device admin", and they need to specify what specifically they'll use that access for. I imagine (though I'm unsure since it's never happened to me) they need to ask to update those permissions if they want their uses to change.