"But I agree it all depends on testing, testing a lot and testing often."
Yes. And that is not going to happen. Just because there aren't enough tests and *all* current tests are faulty as hell: 30% false negatives is basically worthless.
Which means whole idea of application spying on you is rendered invalid. Of course both Google and Apple knows this, they are only interested of *all the data* they can now legally collect.
Tokens, wifis and bluetooths nearby, everything. Mapped to your advertiser-id, of course: Truly anonymous data is worthless to both.
Biting the hand that feeds IT
