Google is informing by email of changes to the Android location permissions:
We’re making a change on October 15th, 2016 that will affect apps targeting
Yes you need both the permissions if you are using fused provider.
ACCESS_COARSE_LOCATION - To receive location updates from NETWORK_PROVIDER. Adding android.hardware.location.network feature permission is enough.
ACCESS_FINE_LOCATION - To receive location updates from both NETWORK_PROVIDER and GPS_PROVIDER. You should add both android.hardware.location.gps and android.hardware.location.network feature permissions. Applicable for also fused location.