They can, but there's an OS option that basically is "I'm going to say yes, but then effectively do no". Basically it'll pretend to the application that a permission is granted, but then just keep returning empty information or doing nothing with it. So notification perms would then be seen as enabled, but nothing is actually being send to the user.
Unfortunately Google isn't really exposing this to users, so you need something like App Ops or adb to set it up.
Unfortunately Google isn't really exposing this to users, so you need something like App Ops or adb to set it up.