Actually there are a lot of information that an app can do by default without asking for any permissions.
You can check this opensource iOS app: https://github.com/mysk-research/loupe
For instance: check if some apps are installed or not, and a lot of small informations about your device that can fingerprint your phone with 100% accuracy (like the exact time where the phone was setup).
I know Loupe, very cool project. Yes, as I said fingerprinting is the biggest risk, but personal data, photos, location, microphones, camera access are locked (which is what concerns most people).
Fingerprinting I would argue it's a problem on all platforms though, web included.
For instance: check if some apps are installed or not, and a lot of small informations about your device that can fingerprint your phone with 100% accuracy (like the exact time where the phone was setup).