Google holds the app developer accountable for any policy violation caused by a bundled SDK — ad networks, analytics tools, crash reporters — regardless of whether the developer wrote or controls that code.
Very commonly triggered when an ad mediation SDK updates itself and starts requesting a new permission or sending data the developer never configured or reviewed.
"Your app contains an SDK that violates Google Play policy. As the app's developer, you are responsible for ensuring all SDKs used comply with policy, per the SDK Requirements."