App permissions are shown in app setting after removing from Manifest

Those permissions might be from a library you use. For example, the zxing-android library includes the camera permission in its manifest, which is then merged into your own app manifest.

To detect where the permissions come from, have a look at the manifest merger logs. The file is located at <module>/build/outputs/logs/manifest-merger-<flavor>-<build type>-report.txt.

This file will be created after a successful build. You can open it with any text editor, or even in Android Studio.

After you opened it, search in the file for the permission using it's name. For the Camera permission, that would be android.permission.CAMERA.

You will find a line like this one:

uses-permission#android.permission.CAMERA
    ADDED from [com.journeyapps:zxing-android-embedded:3.6.0] /Users/username/.gradle/caches/transforms-1/files-1.1/zxing-android-embedded-3.6.0.aar/1757efe0137484c73d2ca6008406df96/AndroidManifest.xml:22:5-65

So in this example, you can see that the Camera permission was imported by the zxing-android-embedded library.

If you are not changing the targetSdkVersion of all your imported modules, It will automatically inherit some implicit permissions.

Also, adding library that might be using those permission will list your app to be using such permission.

You will need to check if your module or library that you are using are not requesting those permission.

Finally, you can check all permissions your app is requesting by

aapt dump badging build\outputs\apk\foo-release.apk

That prints out the list of permissions used by app.