[LoganDark]

Specifically GMS runs as a "privileged app" (that's what priv-apps stands for) which can declare access to permissions in the manifest that non-privileged apps can't even ask for.

[UncleMeat]

Importantly, this is largely a property of preloaded apps rather than GMS explicitly.

[LoganDark]

Yeah, they are curated by the author(s) of the Android build that the device is running.