I am fully aware of what vpn services to use and not. I am not using Express VPN, I am simply doing research for a master thesis, when I came across these results from Express VPN. If you have any ideas or corrections, please let me know why a VPN provider would need to have access to these permissions.
Screenshot is from Exodus service, which let's you view what exactly perimissions and trackers each app uses. You can check out the results and the tool for yourself here: https://reports.exodus-privacy.eu.org/en/reports/com.expressvpn.vpn/latest/
I use Express VPN and the camera permission is relatively new as I don't have it enabled and it's never asked me prior to enable it. I dug through the app and found it within their new password manager when you add a new credentials it offers you to help setup 2FA with the major providers and you can optionally scan a QR code with it so it's a benign convenience feature.
Bluetooth on the other hand I cannot explain unless it's to proxy any connections Bluetooth devices might make.
thanks for the insights :)