Yes. Flipper is a debugging tool that is unused in production builds but included in the APK. We simply have to add the configuration to stop it from being bundled. Unfortunately, it is added as a debugging tool in React Native by default: React Native Support | Flipper (edit - adding code reference: GitHub - facebook/flipper: A desktop debugging platform for mobile developers.; note Flipper is completely open-source and not an analytics platform, and it’s also unused in the Skiff Mail app).
Firebase, as I wrote above, is used to send Push notifications, which Signal used to use. There are pros/cons of different push notification services, but we do not use Firebase analytics. That’s quite clear from our Privacy Policy as well.
Exodus does not report on any running code, network activity, or anything else - just the class names it can find in the bundle.
What permissions are you particularly looking at?
Fingerprint/biometric have been added to prepare for hardware key/biometric usage, which we rolled out. App badge, wifi state, network state, vibrate, and settings seem to be for basic app setup.