You second screenshot tells you what "velvet.apk" is: it's the Google search bar app. And that's why it has that insane list of permissions, because Google give it access to everything. That is not your problem.
The only bluetooth-based attacks I've heard of that don't require user interaction (i.e. you agreeing to accept something) are fairly old: if your phone is running Android 9 or earlier then you might be vulnerable to these, but I don't think more recent phones should be.
The only bluetooth-based attacks I've heard of that don't require user interaction (i.e. you agreeing to accept something) are fairly old: if your phone is running Android 9 or earlier then you might be vulnerable to these, but I don't think more recent phones should be.