During the time between granting the permissions, and removing them, couldn't those permissions be abused? The URL modification solution prevents this problem.

Exactly what I thought. An app will potentially already have your whole social graph by the time you get to change those settings.

The social graph is not secret. Apps don't need to ask any permission to get it. https://blog.facebook.com/blog.php?post=197943902130

Yes, in fact some apps post to your timeline immediately with a message encouraging your friends to add the app.

thanks for the link

"This app can:" section with perms configuration is what I want to see on authorize URL.