Generally end users just press yes to all privilege questions, so there is no point of asking, as its just one useless dialog that bothers the end user experience. There is no point of asking question that users dont understand anyways (well yes 1% do understand, but do you want 1% to spoil the experience for 99% of other users). Those 1% are able to do their own hardening in developer mode anyways (as you can freely tweak android app permissions from commandline).

Malware gatekeeping is done at store QA state (when in developer mode all bets are off anyways) and QA checks that application does not have suid bits nor privileged-group to access the privileged data directory. No Aegis will prevent that anyways as there are always ways around it, even on N9 it was easy to make malware application that steals all your data (event the aegis protected data).