Well on Sailfish and such we don't grant permissions to installed applications so I suspect it would be even easier to make naughty software than Android but not one bothers as the userbase (potential targets) are too few.