If you started asking permission for every little detail
Sure, but the permissions at the moment are not granular enough, like getting the IMEI number, or listening to certain broadcast intents like when you plug in your device. They may seem 'small', but can build a nice profile of the end user. Android can track when you switch from WiFi to LTE, and they can use various location features even when disabled (there were a few articles about that recently).
This is as intuitive it gets.
I think if users knew what that permission really meant we'd see a different attitude, if they knew it was being uploaded to some russian server they'd feel different.
iOS is TOO restricted
Yet Apple is known as the 'privacy' company which isn't actually true, I mean they do more than Google but they're just as bad in other ways (go read r/apple at times, Apple sometimes does things that would violate the whole 'privacy first' thing).
What has GDPR to do with Android in this case?
GDPR was supposed to give users their privacy back, or at least put users 'in control', and code (kernels, OS and applications) should respect the regulations like this. If you think of the contacts permission, if I gave you my phone number, you added it as a contact and had Facebook installed, they're getting that data, and I did not consent to that (I consented giving you my number, not Facebook).
Android fundamentally doesn't respect the GDPR in this way, I can't imagine it wouldn't apply to the kernel or operating system yet for websites it does. Even VSCode (a text editor) had to implement various GDPR compliance features, so Android should do the same.
Android shouldn't be in control of my data, I should be
Yes, an individual should, but Android is the platform that stands between you and the application and your data. That's why it needs to allow users as much control as required. Simply tapping 'allow' to location without context (brand new install, first start up) is not ideal.
Allowing apps to do as they please with this data is also not ideal. For example, if an app was based in russia, collected much data and uploaded to a server, whose to blame? Google (Android), the app, the end user for tapping 'allow'?
Google should be more proactive here, actually reviewing apps/SDKs and ensuring GDPR compliance, which I'd imagine is no easy task, but when you can just include Facebook SDK and they're collecting that data without the user even knowing...
...You know somethings fucked.