Originally Android apps could draw over top of any other app though which is a phishing nightmare. It took them a long time to make that a permission, and then everyone granted it until they finally added the bubbles API recently.

Permissions are difficult to get right, and Android is unfortunately pretty slow to react.