An old trick you could do on old physical fax machines was to tape a couple of sheets of black construction paper together, feed them into the machine and tape them into a loop. Dial your special person and burn through all their toner. Of course, now it would just generate a bunch of emails.
To your last point, yes. The average user doesn’t even glance at the permissions before blindly accepting them. It is also true that an alarmingly high number of users/consumers /don’t care/ about basic privacy concerns that affect things like targeted ads, PII, and information that could be used to affect things like credit score.