The best practice is still to notice which permissions apps require before installing them, don't install apps that seem to require too many permissions, and report to the developer any suspicious activity by an app.
They can take care as to what apps they install and limit them to those from trusted sources, and they can be careful as to what permissions they give to specific apps, but none of this would protect you from this data leak.