Can an application with the following permissions steal user data? I would like to use an application which is able to blacken my screen (AMOLED) so it consumes nearly no power (of course, while running an app, that cannot be run in the background). The application has other features, too, like proximity sensor driven blackening.

To make the app able to provide all the features, one has to enable it as an accessibility service (e.g. such services are able to lock usage of "Recents" button and so on). Accessibility services can monitor the users interactions and observe what (s)he types. This is a security risk (think of a keylogger).

Looking at the manifest file, the following permissions are required: RECEIVE_BOOT_COMPLETED, VIBRATE, SYSTEM_ALERT_WINDOW, BIND_ACCESSIBILITY_SERVICE, USE_FINGERPRINT, BILLING. My understanding is that given there is no network accessibility, this app (or at least this version) is unable to send user data to anywhere, so it cannot steal anything. Is this right?

Any other related comments are welcome.
Yes, it could potentially steal your data...

BIND_ACCESSIBILITY_SERVICE can be a dangerous permission as it can allow to the app to view data in any active window, and any data you enter, among other things. More information can be found here. 

In the information page for the app you linked, it clearly states how this permission is used and why it's necessary for this kind of app (kudo's to the dev, many apps do not explain why they request dangerous permissions, sometimes purposely). The best thing to do is look at reviews for potential "issues" which does not seem to be the case with this application. 

Be aware that although many apps have the permission to "steal" your information, legitimate apps generally do not without clearly stating so in their terms and conditions. 

The rest of the permissions are mostly benign... 


RECEIVE_BOOT_COMPLETED - Self-explanatory
VIBRATE - Self-explanatory
SYSTEM_ALERT_WINDOW - Allows apps to create windows on top of other
apps
USE_FINGERPRINT - Allows the app to use the fingerprint scanner
hardware (but not the fingerprint data, so pretty safe)
BILLING - Allows for in-app purchases  

Source


I don't believe network access has to be implicitly defined any more, but I could be wrong... It would have to be implied with the "BILLING" permission, although I have no reference for that.