Google Drive and Google Calendar permissions are not that great. IIRC there is no distinction between individual CRUD actions, so if the app wants to create a file they also need perms to edit and delete.

This is the most common thing to cause alarm; Google's permissions are a little awkward.

We are not reading all your files - we are only reading/writing to the google sheets input as a link to our bot.

We're looking now at turning off access for anything outside Google sheets, so this message and permissions system is less alarming.