That's just the first example I found in Google. I've seen news about dozens or hundreds of innocent-looking apps in Play Market / App Store with hidden ad/spy/mal-ware inside. Surely you have to explicitly allow them to run (install them yourself) but how do you know which app is clean and legitimate and which is not?