This is by design. For the apps on Google Play Store, Google wouldn't look at these because it's been possible to do all these and more using the APIs provided

This is by design. For the apps on Google Play Store, Google wouldn't look at these because it's been possible to do all these and more using the APIs provided by the Android OS all along, even before the granular runtime permission model came with Android 6 (Marshmallow). I always dread the thought of people not understanding these permissions and letting apps have all kinds of permissions — access to all text messsages, privilege to send text messages, access to call history and privilege to make calls. Many apps read the text messages to process one time passwords/codes sent as text messages, thus avoiding the user having to enter them manually. These privileges have never been available in iOS for third party apps, and I appreciate Apple deciding to err on this side of the privacy equation (though Apple could still do a lot more on app permissions). Taking the same example as above, iOS apps that need one time passwords/codes depend on the user to enter them manually.