Indeed.
It was shortly after I started developing Android apps that I realized I really needed to install a firewall to ensure that no apps can communicate from my phone to the outside world without me specifically allowing it.
Android app permissions -- while they've improved -- are still pretty much a joke. They're far too coarse.