Rightly so, and not paranoid at all, entirely sensible. Once an app is installed, who knows what the software is doing; and it's running on the device that might contain the logon details for your banking, email, investments etc, quite apart from your photos and anything else on there that you'd not want complete strangers to have access to.
An app might be entirely innocent/trustworthy when it's installed but if the author wants to, or sells the product to somebody else with more nefarious intent, or a third party code library they use is similarly compromised; all it takes is an update to plonk malicious code on your phone. Best use a browser wherever possible, as that protects you, especially if you use addons that prevent the web site you choose to visit talking to other web resources you didn't choose to be exposed to.
It's hard to completely avoid apps these days of course, so I run 2 phones. One has the applications that I absolutely need to run but contains almost zero personal data and is locked down as hard as possible, it stays switched off except when I want to use something on it and I'm very reluctant to update anything on it. The other is pretty much just for listening to music/books and looking at the news etc, and contains what little personal data I put on it like contacts and photos - and the two remain entirely separate.