I recently had an app fail the security review because I didn't check CRUS/FLS permissions for dynamic SOQL queries.
To "fix", I've created a few functions that check the appropriate permission for the object / fields of these queries and throw an exception when there isn't permission.
I'm running previously working unit tests and have found that some of them are failing with the exception thrown by these checks. I've resolved them by changing the FLS from hidden to visible in my dev org.
Do I need to make sure the same permissions exist in a managed package? I know the user is prompted during install to select which profiles the package should be visible to, but I don't think fls are set when this happens (it looks like they default to hidden). Will this cause permission checks to return false?
If I do change the visibility of fields, would they show up in page layouts automatically (I have a few custom fields in Opportunity for example - I don't want this to happen)?