Devs do have to declare permissions and it's not voluntary. If an app doesn't have a declared permission for, say, internet access, when it tries to connect, the system will block this request and will issue a security exception.
I have ignored lots of apps (popular also) when i don't like the...