That would be valid concern if you could not deny the permissions meaning this doc is out of date. I have both iOS and Android and have the permissions set to d

That would be valid concern if you could not deny the permissions meaning this doc is out of date. I have both iOS and Android and have the permissions set to deny as they are not essential to the operation of the application. Also, these concerns would pop up in the reviews if you could not deny the permission if it asked for it. One of the reasons I looked at MS Authenticator because it is one of the highest scoring and reviewed authenticator apps, so it would have taken a hit on the score if this was not possible.