Curiously, it looks like Google's AOSP music app requests READ_PHONE_STATE but unless I'm missing something they don't use it - relying entirely on focus loss instead. Granted, I'm not sure anything actually uses this code now...
Which doesn't really help the users stuck on Android versions that never get any update or bugfixes. In which case apps have to take the pragmatic route and just work around the issue. Even if that requires a scary permission.
No user would point to Google and say »VLC doesn't pause when the phone rings, fix the ringer, please.«. Rather they point to VLC and say »VLC doesn't pause when the phone rings, fix VLC please.«
Split your APK based on SDK version. Have different manifests with different permissions & code for the respective versions. The new Gradle toolchain makes all of that easy to do, but it is tough to maintain lots of version specific code long term.
http://developer.android.com/training/managing-audio/audio-f...
http://android-developers.blogspot.com/2013/08/respecting-au...