So non globally routable ip ranges and mdns access is squashed into the same permission group as access to bluetooth peripherals.
(But according to docs not in all cases. I could interpret their wording as system modal mediated things have contextual grants like video cast intents or gateway's dns. But they are light on details there.)
From a fingerprinting perspective that makes sense.
But from an attack surface consideration its horrible.
....