The developer can obviously trust themselves and the user has trusted that particular developer (and the app store approval process) as they can already use the

The developer can obviously trust themselves and the user has trusted that particular developer (and the app store approval process) as they can already use the phone features allowed to that app. If you use Flurry/Crashlytics/... then that is an additional entity (of many people) that both the developer and the user are trusting.