Update: I shared this article in a few places and then a few weeks later an engineer from Meta who I'll let be anonymous DMed me and told me to check out the rankings in the store. I did a quick category search and sorted by avg rating,

We recently noticed that something in our Unity Android app's build process was adding unwanted permissions to the final AndroidManifest.xml, specifically READ_PHONE_STATE. This might be due to some library we're using or something about Unity 6 (we didn't really investigate this)