Ok, so after a bit of research I found that the reason READ_EXTERNAL_STORAGE and READ_PHONE_STATE was added was because I didn't to do the "automatic refactoring" to get rid of the error ("The minSdk version should not be declared in the[...]" issue) in android studio.
I just deleted the lines that caused the error and never added them to the correct place. Android studio therefore added extra permissions because there was no minsdk defined.
That's what I think was happening at least. Anyways "automatic refactoring" to solve the first error in android studio removed the permissions from the app bundle.
This bug report is about the error you get when you export to android studio and how you can solve it.
github.com/Scirra/Construct-3-bugs/issues/2875