I'm guessing they used some framework and the libraries they used ask for a broad set of permissions because they offer access to their functions. But they're not necessarily used.

Also considering they're asking for a permission for a protocol that was shut down 7 years ago, the framework must be quite old. Android permissions were less granular back then.

I know someone in Germany and their covid tracking app tells you when and where you were close to someone who was last tested positive. So everyone does it the same way, recording location.