The wording does seem open-ended, but note this phrase
> If you choose to link your Microsoft Xbox Services account with your account on a non-Microsoft service or sign in to your Xbox Services account to access a non-Microsoft Service...
I work on a service that tracks game activity for users, but we require them to go through the OAuth process and explicitly give us permission to do so.