The empty permissions page is weaker evidence than people in here are taking it for. That screen only lists runtime permissions, so INTERNET, ACCESS_NETWORK_STATE, FOREGROUND_SERVICE and the rest never show up there whether or not an app has them. Plenty of apps with a blank page can still open sockets.
The manifest line is the actual claim, and it's a much stronger one. Anyone who wants to check it without taking your word or mine: on the Play listing, About this app → App permissions → See more is extracted from the uploaded build, not written by the developer. Or aapt2 dump permissions on the apk. Both show the normal permissions that the on-device page hides.