Hi there!
The build we generate for you contains the Expo SDK, so it still needs those permissions by default. This is part of what allows you to publish JS updates over-the-air to your users without changing the android apk.
You do have the option to detach to ExpoKit, which allows you to control all the settings on the native Android project. I don’t really recommend this because it will introduce a lot more work for you, but it is available.
In the longer term we hope to offer some middle ground solution for this, but right now we just haven’t built that yet.