To be fair to Android, I haven't personally found that to be the case. I went to connect to my workplace's Exchange server and got hit with a host of overkill permissions that I need to give to the Exchange admin. As a result, I went and read about what control Exchange administrators have over connected devices, and decided that getting my work email wasn't worth the risk. So the Android permissions system worked for me.