I haven't actually used Marshmallow yet; only read about the security model.

But historically, apps on iOS can only ask for permissions at run time, not at installation time, and you can refuse any permission if you choose (and restore it later if you want). So if an app wants to use a camera, it can either (terribly) ask you the first time you run it, or (nicely) ask you when you do something that uses the camera, and app store guidelines say the app has to not break horribly when it is told no.

In Android (historically) at installation time you get a list of requested permissions, and you either accept them all ("can access the microphone", "can access your contacts", "can access your browser history", "can control your phone", "can implant thoughts into your mind") or you can opt out by not installing the app. That's the scary thing; you go to install a todo app that wants to access your contacts -- what do you do? Is it malware? Will it be changed to be malware in the future?

From what I can tell, the interface in Marshmallow is still annoying in that the app tells you what it is going to ask for at install time, but doesn't get granted those permissions until it asks explicitly and you say yes.

In marshmallow, apps that are built for marshmallow behave like iOS, in that they will install without asking for permissions. For old apps, they will behave like previous versions of Android and pop up a list at install time. Those permissions are granted at install. You can go into settings and disable granted permissions in both cases (with a warning that things can break for old apps)