Are app permissions needed when the stuff, which normally requires that happens in Android WebView displaying a website?

I have a problem. If the app displays a website in a WebView and this website wants for example to access device files, does it require storage permission? The same with camera, geolocation etc. When I tried this, it works both with and without appropriate permissions (I tried that with geolocation and storage), but some people try to imply that the permissions are required. Why is that?