Yes, you're right. A better granularity on the permission settings would be a nice feature to add in the webstore. Just to comment on this point, "Your tabs and browsing activity" comes from the fact that the extension modifies the style and UI of Gmail within your browser and so needs to know whether Gmail is open in your browser (i.e. tabs) to apply those changes, nothing more. To make things clear, Gmelius will never access, read, store, or transmit your personal data.

To inject a content script, you just need permission to access that site.

And if you're injecting a script, you can read all the data off that page.

But you don't need "tabs" aka "Your tabs and browsing activity".

I doubt that would make things a lot safer. With permission to modify only the stylesheet, one could already change the login form to phish your password.

How? I agree that something like that would be risky (you could style the delete button to say "reply"), but I'm not sure how you could do that. Stylesheets can't change a form's action.

I was thinking it would be possible by crafting pseudo elements to a replacement login form, but after reading some more that actually does not seem possible. Maybe one could make the email composition form look like the login form under some conditions.

On the other hand, reddit allows people to upload stylesheets for their subreddits, they only re-host the images in them and that seems to have worked out well.