Thanks!
The app lets users send tweets or DMs and I didn’t find an obvious way to narrow the required permissions down to just that. But a few people have now pointed this issue out and I think I will just remove that functionality and require only read permissions.