That would be my intuition, but can you elaborate what specifically the app (if not given extra permissions) can do? Assuming the user doesn't change settings, web sites (at least if used semi regularly) can store a persistent cookie, so keeping the user identified is possible with both.
The only thing I can think of is regular background pings to track the user through IP geolocation.
Unpermissioned access to all sensors like battery, acceleration. Hardware IDs. Background pings (as you said). Push notifications. Seeing which other apps are installed (maybe, I think that one got locked down). All kinds of fingerprinting.
Push notifications are the most likely abuse vector but are gated behind a separate permission. I think they locked down installed apps, and fingerprinting isn't really relevant if they can just set a cookie. Acceleration is also available on the web. Not sure about battery, but most apps (aside from Uber that increases the price if they think you're desperate) can't really do anything bad with that. So I don't see much left tbh.
The only thing I can think of is regular background pings to track the user through IP geolocation.