An app that maliciously exploits some system vulnerability may be extremely dangerous, and does not need "suspicious" permissions.
Apps that you download from the official Play Store undergo some (undocumented) verification process which includes anti-virus scan, but most importantly are banned as soon as some malicious activity is detected by Google or other organizations that specialize in monitoring such threats. This does not mean that you can be sure that an app that you install from Play Store will do no harm, but the risk is significantly higher outside.
I would recommend to have an anti-virus app if you need a sideloaded app which you cannot trust, and if you can, use such app on a secondary device that does not hold your vital data.
Also, Android is constantly upgraded to fix many vulnerabilities, therefore latest system may be safer. If you can, use the latest system.
Use Google's Verify Apps which is part of the Play Services. It can identify some harmful apps. This means that it is worthwhile to use a device with Google Services installed and up-to-date.