This is correct. And it is normal practice for not-truly-native apps (apps using React Native, Ionic, etc.). By declaring every permission in the manifest, they can add new features that would require those permissions without by just updating the javascript code over the air (no play store update / google play review needed).