Google no longer owns Niantic
What are you talking about?
It's developer laziness.
The security policies for that sign-in system are not as granular as Android's security policies.
Normally an app would request permissions at run-time or install-time.