android permissions can come from your own android manifest or any library android manifest. so there may be some library outside of those that you listed which pulls in the permission.
the documentation for permissions in app.json applies to the classic build system currently - not eas build. you can add READ_PHONE_STATE to an block list using a config plugin. see this repo for an example: GitHub - brentvatne/blockperm
here is the relevant commit: config · brentvatne/blockperm@4ca2c5b · GitHub