I am fully aware of what vpn services to use and not. I am not using Express VPN, I am simply doing research for a master thesis, when I came across these results from Express VPN. If you have any ideas or corrections, please let me know why a VPN provider would need to have access to these permissions.
Screenshot is from Exodus service, which let's you view what exactly perimissions and trackers each app uses. You can check out the results and the tool for yourself here: https://reports.exodus-privacy.eu.org/en/reports/com.expressvpn.vpn/latest/
Dunno about Bluetooth, but isn't Expressvpn pushing their new password manager? I imagine it's a separate app, but if not, then it would make sense to have camera to read 2FA QR-codes.
You can have internet over bluetooth, both as a hotspot and as a tether, maybe that's the thing?
Unlikely i feel tho.