If I was Google, and I would be doing this, it would be not based on security requirement but rather:

CYA: so that users can't sue Google in case of wrongful usage of data by a bad app

Uniformization / homogenization of permissions names.

Reduction on the CPU load with removal of costly and non billable processing (eg structured queries).

Ps: I've been a security guy for 30+ years.