If I was Google, and I would be doing this, it would be not based on security requirement but rather: CYA: so that users can't sue Google in case of wrongful u

If I was Google, and I would be doing this, it would be not based on security requirement but rather: CYA: so that users can't sue Google in case of wrongful usage of data by a bad app Uniformization / homogenization of permissions names. Reduction on the CPU load with removal of costly and non billable processing (eg structured queries). Ps: I've been a security guy for 30+ years.