Maybe they like phone numbers. Nevertheless Google Authenticator's permissions are in another league completely and one should probably be as suspicious of Google as Facebook.

Version 5.00 can access: Camera

    take pictures and videos

Other

    create accounts and set passwords
    full network access
    control Near Field Communication
    use accounts on the device
    control vibration

I guess it needs camera access to use QR codes? Maybe NFC falls in the same category. Not sure about the others though.