This is basically required for clueless (and even not so clueless) users.

If there's a chat app I installed 3 years ago, with no intention of giving it camera access, and I suddenly need to use that app for a video call, I don't want to be stuck debugging broken camera issues for two hours. I'd much rather have the app tell me that it doesn't have camera access.

They can, but there's an OS option that basically is "I'm going to say yes, but then effectively do no". Basically it'll pretend to the application that a permission is granted, but then just keep returning empty information or doing nothing with it. So notification perms would then be seen as enabled, but nothing is actually being send to the user.

Unfortunately Google isn't really exposing this to users, so you need something like App Ops or adb to set it up.

Yep. Just today I had a tram/bus ticket purchase app refuse to work unless I grant it Phone access.

Of course, that way they can so they can refuse to work until you uninstall or give in to their demands. There are other operating systems that present fake data at least.