Generally for permissions, set superuser context before and clear after:
thing.AddRunTimePermission("PropertyRead", "*", "myGroup", "Group", true);
Note for The Templates, the intent is to grant run time privileges on the instances created from the Template and not on the Template itself. So AddInstanceRuntimePermissions works and the AddRunTimePermission does not work on template itself. As Templates do not hold the actual values, they are there for just defining the metadata.
So what you are saying is that there is no way to add permissions in the extension itself. Only after importing the extension the admin needs to do an extra operation to setup permissions?
If the admin needs to do an extra operation to setup the permissions in the Composer, he might setup the permissions directly rather than running manually a service.