As someone with a startup that heavily leverages Gmail OAuth, this kind of thing is upsetting because it causes folks to lose trust in the technology. Google is partly at fault here though. There should be an audit trail visible to users so that they can see every time a third-party service downloads a message or an attachment. There should also be more granular scopes so that folks can, for example, authorize access to only email threads with certain labels, including the built-in labels. (E.g. only personal email or only commercial email.)

It would also be nice if there were a way for folks with the gmail ID of a thread to download the parsed thread/attachments from Google, with a special scope designed for this. (So that services can get the entire DKIM-validated thread by just letting users copy an address, forward the last message, or via a plugin.)

I spent over a week writing our TOS, privacy policy, and security page, but privacy laws and the underlying technology should be sane enough by default that people shouldn't need to feel like they need to closely parse every word before signing up.