How can an Android app access ringtones without permission?

Question

I have Android 5.0.1(API level 21).

I'm using NewRelic app version 1.9.3.(I can provide this version apk if necessary).

From update 1.9.4 their app started demanding access to READ_EXTERNAL_STORAGE, aka "Photos/Media/Files" permission.

When I contacted the company for an explanation for this permission demand, they stated that this is "required" to access my ringtones/notifications stored on external SD card. However, I have always kept my custom ringtones and notifications on my removable SD card and I have always been able to use them in this app without it ever asking for this permission.

How is it possible that this app can access my ringtones without having this permission? Or is the company's explanation for this permission grab unjustified?

Answer 1

What most probably happenned is that with MarshMallow, Android have updated their cretificate permissions on their apps. Hence probably before this, new relic was able to fetch the ringtones automatically with a different permission.

With the latest updates, the app needs to access the external storage to fetch the ringtones, which seems legit to me. So the company's explanation is correct.