Being Open Source doesn't make it impervious to being a vector for exploits, as Heartbleed brutally demonstrated. It shouldn't be requiring permissions it does

Being Open Source doesn't make it impervious to being a vector for exploits, as Heartbleed brutally demonstrated. It shouldn't be requiring permissions it doesn't need or isn't using "yet". Permissions used rarely or only in certain configurations can be prompted for granting on the fly in current Android releases, can't they? Does the Play Store really limit you to one copy of your app to span every supported major release of Android?