I've used Cerberus for quite awhile. It's very nice and powerful. The reasons for the permissions on these apps are for what they are capable of....tracking the phone, turning on the GPS, setting passcodes, wiping the phone or SD card, locking the phone, controlling the phone via SMS, hiding the app and preventing it from being uninstalled, taking photos and all of that through a web browser.Cerberus even will record audio or video from your phone and email it to you (not sure of others). You can send an alarm to the phone (that sounds like a police siren) with a message and the phone will take a picture when the thief dismisses it and send it to you. That functionality is going to take a lot of permissions to pull off.
I'll point out the Cerberus will let you add up to five devices onto your account as well, so for a couple of bucks, I have it on my wife's and kid's phones as well. It's a good deal for the peace of mind and I've used it several times to find my phone that I misplaced (used the picture functionality to find my phone was left under the seat of my car or in my yard)
The nice thing about Android Lost and a couple of others though is they can be installed and configured after the phone is missing out stolen. Others, like Cerberus require it to be installed prior to the theft.
Sent from my SCH-I535 using Tapatalk 4 Beta