[gpm]

More generously I'd assume because

- It's an early prototype so they haven't dealt with fine grained permissions

- They really do want to do things like access private repos with it themselves

- They really do want the ability to do things like checkout code, create PRs, etc... and that involves a lot of permission.

[skeeter2020]

every one of your "more generous" assumptions is the opposite of what should be their process. It's the equivalent of "vacuum up as much data as possible and then decide what to do with it". Not acceptable.

[gpm]

It's "vacuuming" that data in the sense of giving API access to a tool that runs on your local computer, that seems acceptable enough for me in the early stages of developing a tool.

The other privacy complains I have regarding them harvesting usernames and email addresses... not so much.