People are used to granting access to an app without assuming that it's going to take full advantage of that access. I have access to a lot of repos. Like, a LOT of repos with a lot of collaborators. And I just had some app add webhooks to every single one. I'm glad I could remove them with 'logout', but I would have really appreciated a more obvious message.