In regards to #2: It's possible for people to create Connect applications that are read-only:

https://stripe.com/docs/connect/reference see the `scope` under request parameters.