The people who used Kogan's app
explicitly granted it access to that data, albeit for academic, not commercial, purposes.
Not exact matches
When you were done there, you could re-enable all of Android's security settings, uninstall the app, then get a root management app like SuperSU to ensure that no other apps would get
access to your device's internal file system unless you
explicitly granted permission.
Device administrator
access has to be
explicitly granted by the user (you), but just like with app permissions, it's possible that you may have accidentally enabled this feature, which can be potentially disastrous.
As a privacy protection measure, users will need to
explicitly grant apps
access to fitness data, probably through a new permission at app installation.