Google Play includes permissions that have been taken out in the latest version of an app https://twitter.com/ServiceNSW/status/1189390044273856513

IIRC a former developer explained (on reddit?) they explored other functionality like bluetooth LE verification rather than QR code