Poweramp currently requires following permissions:

WRITE_SETTINGS - to be able to set ringtone and for temporary display timeout change while in lockscreen and direct unlock is enabled.
WRITE_EXTERNAL_STORAGE - to be able to write album art cache to sd card
WAKE_LOCK - to be able not to sleep when song is played
INTERNET - to be able to download album art and show help
ACCESS_NETWORK_STATE - to detect Wi-Fi mode and download (or not) album art, according to the options set by user
DISABLE_KEYGUARD - to be able to implement Lock Screen
MODIFY_AUDIO_SETTINGS - to be aware which audio output is active for Equalizer per-output preset assignments (yes, there is one permission for both read and modify audio settings, Poweramp just reads them)
BROADCAST_STICKY - to broadcast sticky events for Poweramp API
BLUETOOTH - to check BT status
FOREGROUND_SERVICE - Poweramp v3: required to be able to play anything in background
READ_PHONE_STATE - Poweramp v3: not used. To be able to pause (and then resume playing) when phone is ringing/call is in progress.
SET_VOLUME_KEY_LONG_PRESS_LISTENER - Poweramp v3: used to assign track switching action to the volume buttons
VIBRATE - Poweramp v3: used to vibrate if appropriate option enabled
SYSTEM_ALERT_WINDOW  - Poweramp v3: used on Android 10 to allow lockscreen

arm-uni edition (from website/forum):
org.onepf.openiab.permission.BILLING - for in-app app unlocking Poweramp v3: not used
GET_ACCOUNTS - for in-app app unlocking Poweramp v3: not used

We're trying to keep this permission set as minimal as absolutely possible.