1) Use DroidLight. It's by Motorola, but it works on non-motorola phones too. It requires no permissions.
2) We are in a sad state of affairs.
9 out of 10 flashlight apps in the Android store require unnecessary permissions. The Android store needs ONE flashlight app. Maybe 2. Unfortunately, idiots download apps that requires 100 permissions, then rank it a 5/5. This is such a trivial problem for Google to solve: one Google Play Store employee could ban 90% of those apps with a day of research and resolve the problem for the most part.
Even in the wild wild world of PC shareware, malware wasn't as bad as it is in the Google Play store.