Chrome for Android seems to require no permission to download files and install web apps. Disabling storage permission does not prevent the browser from downloading the EICAR test file, and disabling app downloads does not prevent the installation of the Android Developers web app.
In further detail, installing the Android Developers web app seems to trigger a download with Google Play Services, but does not show up in the list of installed applications in Google Play. When attempting to access its page in Google Play through notifications, apparently it doesn't exist and shows an error has occurred.
I'm not sure whether this is an intended feature or if my device has been compromised.
WebAPK
and Chrome doesn't seem to need the usualy install app permission to install such an app. Note that the app is not downloaded but generated by Chrome locally. web.dev/webapks