Malware often hides in apps requesting permissions unrelated to their function — a flashlight app wanting your contacts, say. Reviewing and denying excessive permissions limits what a malicious app can reach.
“A flashlight that wants your contacts is up to something.”