Apps can seemingly call external ones: for example, Google Authenticator hands QR code reading off to Barcode Reader, and thus doesn't require the permission fo

Apps can seemingly call external ones: for example, Google Authenticator hands QR code reading off to Barcode Reader, and thus doesn't require the permission for itself. Having a PayPal "Till" app to augment the main one for microphone/QR users would be ideal, and not violate the permissions. So there is some blame, though I agree: Android's permission model being fixed is more important.