I'd be cautious about 3rd party flashlight widgets, since they're notorious for adware and even malware. There are tons of them available on Google Play -- if you consider installing one, check its permissions and make sure it only asks for Camera permission (and possibly Network permission, if it has ads). The LED flash is part of the camera module, which is why it needs Camera permission -- but it otherwise has no business needing permission for Storage, Contacts, Microphone, etc.