I have not granted SMS permission to WhatsApp on my device HonorView10 running on EMUI9. Recently I changed the number registered with WhatsApp and it send the verification code to new number (the sim is on same device as it is dual SIM). WhatsApp read the SMS and completed the verification process. Is it possible in Android to read SMS without permission? Or it is bug in EMUI9? I am just curious.
WhatsApp could access SMS without having permission to it
I think whats app is using SMS Retriever API
SMS Retriever API
With the SMS Retriever API, you can perform SMS-based user verification in your Android app automatically, without requiring the user to manually type verification codes, and without requiring any extra app permissions. When you implement automatic SMS verification in your app, the verification flow looks like this
In some circumstances, you want to help the user understand why your app needs a permission. For example, if a user launches a photography app, the user probably won't be surprised that the app asks for permission to use the camera, but the user might not understand why the app wants access to the user's location or contacts. Before your app requests a permission, you should consider providing an explanation to the user. Keep in mind that you don't want to overwhelm the user with explanations; if you provide too many explanations, the user might find the app frustrating and remove it.
read this https://developer.android.com/training/permissions/requesting
来源：https://stackoverflow.com/questions/54433655/whatsapp-could-access-sms-without-having-permission-to-it