It lists it based on an automatic scan of which APIs the software uses. However, it can't tell if there's dead code and the package doesn't actually use a certain permission, or if there's an additional permission process within the app, etc.
The permissions listed seem to pertain to the uses-permissions in the Manifest.
If the Manifest doesn't request these permissions, and they aren't allowed, they won't work. If I don't put the Internet uses-permission in my Manifest, then any Internet calls I make won't work.
