They absolutely do. Every permission you request has to have a valid justification and the user can only be asked when the permission is actually needed. The AP

They absolutely do. Every permission you request has to have a valid justification and the user can only be asked when the permission is actually needed. The API allows you to specify every single permission and require them at app launch, it's the human reviewer who makes sure they're being used appropriately. I say this as someone who has had apps denied by reviews for requesting a permission that was not needed inside of the version of the app I submitted to the store. They absolutely do review and vet apps for privacy and security.