Older applications not targeting M, will show permissions at install time and be granted by default, but the user will be able to revoke them, the platform will just give empty data or fail. From the preview documentation
Note: On devices running the M Developer Preview, a user can turn off permissions for any app (including legacy apps) from the app's Settings screen. If a user turns off permissions for a legacy app, the system silently disables the appropriate functionality. When the app attempts to perform an operation that requires that permission, the operation will not necessarily cause an exception. Instead, it might return an empty data set, signal an error, or otherwise exhibit unexpected behavior. For example, if you query a calendar without permission, the method returns an empty data set.
If you are worried that old applications can use the permissions immediately after installation, before you have time to disable the permissions, take into account that applications are installed on a stopped state, there is no programmatic way for it to auto start itself. Start on boot may work but it is not precisely immediately. So I think the best action is to go to those old applications just after install and remove every permission you don't want to grant before starting it.