Poweramp currently requires following permissions:

WRITE_SETTINGS - for temporary display timeout change while Show On Lock Screen option is used
WRITE_EXTERNAL_STORAGE - to be able to read/write tracks from/to SD-card
WAKE_LOCK - to be able not to sleep when song is played (lower Androids)
INTERNET - to be able to download album art
ACCESS_NETWORK_STATE - to detect Wi-Fi mode and download (or not) album art according to the options set by user
DISABLE_KEYGUARD - to be able to implement Lock Screen
MODIFY_AUDIO_SETTINGS - to be aware which audio output is active for Equalizer per-output preset assignments (yes, there is one permission for both read and modify audio settings, Poweramp just reads them)
BROADCAST_STICKY - to broadcast sticky events for Poweramp API
BLUETOOTH - to check BT status
BLUETOOTH_CONNECT - to detect Bluetooth output codec/parameters
BLUETOOTH_ADMIN (used up to Android 7) - to detect Bluetooth Absolute Volume
FOREGROUND_SERVICE - required to be able to play anything in background
SET_VOLUME_KEY_LONG_PRESS_LISTENER - used to assign track switching action to the volume buttons
VIBRATE - used to vibrate if appropriate option enabled
SYSTEM_ALERT_WINDOW - used on Android 10 to allow lockscreen

We're trying to keep this permission set as minimal as absolutely possible.