It doesn't change the fact that those permissions are necessary during install. Them saying "oh, don't worry about that, it was a mistake" is laughable.
This wasn't too paranoid for no reason, if you read what Fossify and their mission is about.
Anyone that installed/is using a Fossify app, that actually read about Fossify and their missions statement (and aligned with it), wouldn't be the target user for features like this.
"however the ACCESS_NETWORK_STATE permission was left over by mistake, but any actual NETWORK calls are completely disabled."
Mistake huh? That's assuring lol.
See two everyday. Chatted up a 3 other pixel users last weekend, 2 were using GrapheneOS.