On Android I have had several apps change their privacy settings after a supposedly simple incremental update. It is I suspect intentional to slip these things into an update. Weekly patch updates are "gotchyas" designed to fool the user.
The larger issue is that most recently I have seen separate background processes that are installed along with an app. I only install major name apps and still this is happening. You can stop the service in question and see if it breaks the app but geez.
The bottomline is I no longer install phone apps unless I actually use them every single day.