A legitimate app asks for storage access (to read music files). A modded app asks for the same, but then exfiltrates your photos, contacts, and browsing history to a remote server.