While I agree that the permissions seem over and above what's necessary, there's a trivial solution available that I've been using for many years: create a Goog

While I agree that the permissions seem over and above what's necessary, there's a trivial solution available that I've been using for many years: create a Google account (or several!) that's exclusively used for _untrusted_ services. Would you really care if this - or any - app has access to an empty calendar, can access its empty Drive, or ends up adding an irrelevant email address to a spam list? (By the way, it's not lost on me that you probably already do have such a setup, it's just, I know far too many folks who don't!)