I don't have WhatsApp installed but I had similar question with Truacaller so I will try to explain a bit how it works and how I forced Truecaller to hibernate.
In Android there are services that can be run by actions (triggers). When some event happens ie. phone call or plugged in, this event will be send to all apps that uses Phone Call Service even these apps are hibernated. Some services are critical and cannot be closed when system goes sleep. Application can avoid being dozed by reporting to use these services. I also didn't give the permission to Truecaller but it was active all the time. I even force hibernated it with full version of Greenify (with Xposed module) but it was active anyway.
What I did with Truecaller was to install DisableService (root needed) and saw what services were used by this app. I didn't know what service I should disable so I disabled all. App of course crashed when I tried to open it. So I was repeadtly enabling some services and observing what functions were getting restored. With that I found services that made Truecaller invincible. Now Truecaller works only when I need to check unknown number.