Android's permission system supposedly gives you the power to sandbox a keyboard application so that it cannot exfiltrate data, but the Android UI does not give you access to the full permissions system. Using adb and one of the system utilities (pm I believe), you can add or remove any of the huge set of permissions that Android normally lumps together as "automatically granted to apps that publish in their manifest that they want this".
The easier way to do this is with the App Ops app. It's in the Play Store, but needs either a rooted device, or assistance hooking up to adb, which can be provided by the Shizuku app (from the same authors as App Ops).
