I think the answer is more general than just node-gyp or even npm permissions.

What happens to Android or IOS apps if a new permission is added? I think it’s no different to what happens if you change your app to require different permissions, you’ll need to add that requirement, (on the next publish to npm).

Having said that, I can’t imagine that beyond disk and network, there’s likely to be many more permissions.