Read phone state and identity
With this permission an app can...


read your IMEI/IMSI (to identify your device/SIM), #2 in your list
read your phone number (from the SIM)
which provider is used (again, the SIM)
see whether a call is active (#3) and if so, phone number of the remote party (#4)


Your #1 is simply an introductionary phrasing. With Android 1.6 and before, this permission was required to detect whether there was a call being processed (so a game or media player could pause). This is no longr the case since 2.0 (basically even not with 1.6, but due to a bug this permission was still automatically "injected" by the SDK).

In newer versions, it is mostly used to...


identify your device for target-ads (so the ad provider could tell whether a certain ad was already shown to you)
rightfully by call-blockers and similar apps which need to determine the remote phone number
for several statistics and other technical apps (again, rightfully)


And well, in a way it gives someone the possibility to spy. Some malware uses it (in connection with other permissions) to create a profile of you.

I'd say in most cases the dev is not interested in this, but it's rather the ad module requiring this permission. Concerning this, please also see: What information does stock Android send to Google by default, and how do I opt-out? -- which also covers the ad-modules stuff.