> - if G has the ability to automatically audit necessary permissions, they'd do it when you upload to the plugin store

If they added it more recently then they are just back-applying it to an already existing extension.

Alternatively, you can report plugins as requesting incorrect permissions – I've done this. Perhaps that's what's happened here, lots of reports triggering an investigation.