I'm no fan of Google, but it's slightly more complicated than that, there's a lot of security and privacy stuff that can't be enforced if your app was build 6 years ago and still slopping around.
Does that really matter for a local-only 5KB app that only talks with my phone‘s flashlight, or reads sensor data? Now, maybe for the 500MB adware-filled “flashlight” app that connects to 100s of servers and demands access to everything my device can do, but that would be banned on any competent app store anyway.
I don't know if this is still the case, but at one point the permission needed to access the flashlight also gave access to the camera. And there aren't restrictions on network connections from apps. (I'd love to have app network access restricted by permissions, but that would be a large change.)
And in any case, Android has had built-in flashlight support for a while now, for any phone that has a camera with a flash. Is the "turn the screen bright white" style still useful with modern Android?
No but enforcing policy is manageable. Enforcing reasonable security measures based on nuances and case by case situations is not manageable for an ecosystem of that scale.
