"Android still has fine grained control over permissions. It will ask you whether you accept the permissions the first time and you can turn them off individually at any time.
They aren't hidden away either."
I'm assuming you are talking about the permission controls in Android 6.0 and higher.
Yes, this was a welcomed and much needed addition but the permission controls in AppOps that I am speaking of actually go deeper.
The Lineage OS I am testing has the permission controls like the ones introduced in Android 6.0 but there is a new option in "Settings" named "Privacy Guard" where you can enable/disable/ignore things such as: Wifi scan, coarse location,read clipboard, vibrate, volume,record audio, keep awake, notifications/toast,run in background etc.
The list of controls actually grows as the apps requests them.
But it is still missing the most important control of all which is the ability to deny an app access to the internet.
For this you still need to strip that permission from the apps manifest and resign/repackage/reinstall an app or block the app with the IPtables firewall as ROOT.