If you remove package-json.lock and node_modules and re-run npm install, do you still have references to expo-location in the newly created package-json.lock?
The references to *_LOCATION in ./node_modules/@expo/config/build/android/Permissions.js should not matter, since you say you have set expo.android.permissions to ["CAMERA"] in your app.json.
If the above doesn’t work, please post your app.json here and the output of:
grep location package*.json yarn.lock
EDIT: I think you need to be on at least SDK version 39. Also, to see what your APK is actually including, see this: Listing permissions of Android application via adb - Stack Overflow
See also: How to decrease permission on Android. - #2 by notbrent