Unfortunately, permissions are only configurable on a read only or read/write basis. Since this app changes settings, it has to have the read/write permissions. I don't save access tokens, so it reauthorizes every time you click enable/disable. I just posted the code on github for anyone who's interested. Here is the link to the code that messes with your twitter account: https://github.com/willcosgrove/retweet-rip/blob/master/app/...
Twitter's API permission levels are really coarse grained [0]. I assume it needs write access in order to change the timeline, but some more detail from the author would be nice.
Someone posted this [1] during a similar discussion yesterday. It shows you what a world without retweets is like without requiring anything beyond the minimal permissions required to do so.