Many apps require unnecessarily broad permissions with Flatpak. Unlike Android and iOS apps they weren't designed for environments with limited permissions.

> Unlike Android

My experience with android apps seems to be different. Every other app seems to be asking for contacts or calling or access to files.

You can usually deny those. If they ask for them without a good reason, that's already suspicious.