Your flashlight app has access to your contacts.
Your puzzle game has access to your microphone.
You don't remember granting either.
The problem isn't the apps. It's that nobody taught you to audit permissions every 6 months.
When did you last check what your apps can see? Be honest.