It's amazing how topic on that Sailfish has nearly zero permission system is nearly missing from the discussion

Again, Flashlight could have stolen your home videos. It hasn't and most of its code is naively available in plain text, but dozens other apps you installed already can

It is mostly about QA indeed and you can never trust 100% anyway (QA doesn't parse the code), but wouldn't you feel better if you were guaranteed to see a system approval dialog before Flashlight wants to access network? Oh boy, then me (Flashlight author) would never skip explanation of why network access is needed and app would work without network as well.