FWIW, crap like this is why I'm not a member of the Android or Apple communities. But I don't believe for a second that a debian phone would be much better on this if sales were the size of those for either of those phone platforms. But default, most linux setups give the local user and any apps they're running full access to the network, and full access to the microphone. Your address book is usually just an XML file in your home directory (or at least is is for me using claws-mail).
The benefit open source OSes like linux have is usually you can read the source to see if it's spying on you and reporting to some random server overseas (although the question remains if anyone has ever reviewed the source against those constraints) - but the Pyra's dbp system somewhat eliminates that benefit, as it makes it easier to ship binary only apps. Now it is possible with defining suitable groups and defining multiple users in different combinations of groups, and running apps under those users only, so stop unexpected access to these services, but that's rarely set up for you by default, and is unlikely to be on the Pyra either. Maybe SELinux helps in setting that up, but it's not something I've played much with yet.
Meanwhile android at least has permissions to allow you to limit what apps can have access to. Only trouble is, with all of these things, if you remove one permission, the app is likely to just stop working and crash. And it's usually not clear how apps are using different permissions for different stuff - you could be using the internet to upload your c4a scores, or it could be tracking how much time you're wasting playing games and sending it back to the russians or something.
One good thing I've discovered on my laptop though it that it's very hard to work out what I'm watching on TV because of all the fan noise it picks up. And my server doesn't have a microphone plugged in ever. Pyra should be a lot quieter though, and with cellular models being potentially online pretty much 24x7 of the time they're on at all, that could be an issue.