How does an app reads an OTP SMS without SMS permission?
Verification by OTP uses a different API which doesn't need read SMS permission. You can read more here Perform SMS Verification on a Server

Hence, the app isn't reading your SMS but using a separate channel to read specially formatted text messages

I learnt of this when an Xposed module to block permissions did not work as I expected (similar case) and the developer explained the reason