I took your comment to say "You have to allow access to your data if you're using OAuth, because that's how OAuth works", and wanted to argue against that. The OAuth protocol is so complicated because it tries to be safe and secure and so it doesn't force any data disclosure. However, I now see that you probably meant "OAuth forces you to accept these permissions explicitely". In that case, we're hopefully both right :)