I'm still a bit confused as to the facts here, but it seems this is about the client software having access to data via apis authenticated with user credentials

I'm still a bit confused as to the facts here, but it seems this is about the client software having access to data via apis authenticated with user credentials. If it's the software acting on the client's behalf, I don't view the client as third party (it's the user itself). Something along the lines of the old Farmville app would be third party. Now if blackberry or apple had carte blanche access to data via an API that was authenticated just based on the company credentials, that would be different.