Yes. That is the case, and we (developers) argued that, the response we received was "but the _users_ may not know, even if the owner has authorized the bot".