I use Express VPN and the camera permission is relatively new as I don’t have it enabled and it’s never asked me prior to enable it. I dug through the app and found it within their new password manager when you add a new credentials it offers you to help setup 2FA with the major providers and you can optionally scan a QR code with it so it’s a benign convenience feature.
Bluetooth on the other hand I cannot explain unless it’s to proxy any connections Bluetooth devices might make.
There’s no oversight for any of these agencies and they have the means and incentive to backdoor cryptography, what would stop them from doing this morality? There’s no possible way that they both aren’t compromised and all we’re seeing now is them firing pot shots at each other trying to convince the reader to join their honeypot because its sweeter.