Because that's what's happening. Having an app with both "read email" and "network access" is basically saying "this app will siphon your email to an unvetted a

Because that's what's happening. Having an app with both "read email" and "network access" is basically saying "this app will siphon your email to an unvetted and likely unsecure third party location". You wouldn't want your bank account info treated the same, would you. Would it be that hard to raise the user's awareness right then and there? Bonus points for offering a sandboxing mode, where the app can only access certain network locations, like Google IMAP servers, and only Google IMAP servers. Extra bonus points for auditing traffic from sandoxed apps to catch them if they try something fishy.