The permissions would be about what abilities the package will have when it executes. If a package uses node-gyp, it has the ability to do pretty much everything and therefore would need to request all permissions.

Same for things like post-install scripts that fetch something from the network.