Virustotal says trojan found.

[tikendraw]

Downloaded the apk from Feb and scanned it before install.

[tutacat]

It clearly has no SMS permissions. You can see that in AndroidManifest as well.

If you are going to use VirusTotal, or any AntiVirus, always run a new scan, and some antivirus are more likely to have false positive. Likewise they may use neural models or heuristics with a degree of error.

To further avoid malware, build from source, since release artifacts may be less thoroughly checked. You can review the entire source code of this app, and you could probably write/make it in 30 minutes, using either code, or visual code blocks. It is a very simple client so easy for even inexperienced people to review the code.