In an ideal world, an Android app that has no permissions would mean that the app can not seriously harm your device.
Unluckily we are not living in an ideal world, especially on Android where the device manufacturer often does not provide the newest security updates to each and every device.
Therefore running a malicious app without any permission on an Android device can end up in a permanent device infection if the device is vulnerable to an exploit that allows the app to get root permissions. Those exploits can work independently if your device is rooted or not, then work even on stock rom devices.
Therefore the risk executing an app without any permission depends on large parts if your device has the very latest security update (see patch level date in Settings -> System -> About -> Security patch level).
If your device has the most recent patch level and the app is not brand new the risk is low that the app is able to harm your device. However if your device has a security patch level months or even years ago even an app without permissions may cause serious harm to your device.
What is possible on different Android versions
There is an old article (2012) on AndroidPolicy: Security scare of the week: What can an app with no permissions do? which lists a few facts about what apps can do without any permissions. Lets try to check some of the facts and check them regarding modern Android devices:
Read data on your SD card
By default on devices prior to Android 4.4 apps had by default read access to the sd-card section:
This permission is enforced starting in API level 19 (Android 4.4). Before API level 19, this permission is not enforced and all apps still have access to read from external storage. You can test your app with the permission enforced by enabling Protect USB storage under Developer options in the Settings app on a device running Android 4.1 or higher. [source]
But even on newer versions there is still the possibility to get sd-card access "for free" in case the app defines that it was developed for some very old Android version. In such a case Android implicitly grants the sd-card read permission (untested: is this still true for e.g. an Android 10 device?)
Note: If both your minSdkVersion and targetSdkVersion values are set to 3 (Android 1.5) or lower, the system implicitly grants your app this permission.
To avoid misuse of those "implicit permissions" Google enforces a certain
targetSdkVersion when uploading an app to Google PlayStore [source]. Hence if you have an app from Google PlayStore that has been published in 2018 or later (latest update) those implicit permissions on the sd-card are impossible.
Read installed apps via
Miscellaneous data from
Android ID, kernel version, and ROM version