Until Marshmallow it had no permission system at all - every app gets access to everything it wants. That's every contact's full details, your full details, all your SMS messages, your location at all times, your email address (you could see a list of what they access, at least, but couldn't stop them).
It finally became more iOS-like in Marshmallow, but first your phone has to actually get the update, then the app has to actually update to target Marshmallow or above. It doesn't retroactively apply to older apps, and Google didn't enforce that apps start supporting it - they only have to if they want to use Marshmallow specific features.
(You do have the option of manually blocking access in Settings, but you have to actively do it for every app before the app ever runs, and you'll get warnings that the app might simply break).
It's something I've frequently pointed to when Android users said that "Android gets everything first". I was enjoying my permission system back in 2008.
It's the main reason I use an iPhone, it's actually why I switched back after some time using Android (after the iPhone finally got custom keyboards). Finally, as more and more apps update, Android will become viable for me again. However, I still take issue with having to put my real name on app reviews on Android.
