Yes, that is correct. It's requested at time of first use only.

On Thu, Jul 26, 2018, 6:21 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
[adding Eric and Harsh to the CC]

On Fri, Jul 27, 2018 at 1:15 AM Denis Kisselev <denis@dkisselev.net> wrote:
> That permission should probably only be requested as-needed but I suspect that wg is targeting an older Android API that doesn't expose that capability.

It was my understanding that only Android 4 would prompt at install
time and Android 5+ would only prompt when actually used. Perhaps I'm
mistaken?