If you download a "Simple Flashlight App" from APKPro and it asks for permission to read your contacts and location – A better app uses minimal permissions. A malicious app asks for everything.
If you need an APK for a legitimate reason (e.g., an app not available in your country, or an older version), use reputable sites that verify file signatures: apkpro me better