Indeed there is a race condition (if that) where you have to allow access at the default privileges before opting out of any of them. I'm sure every single application sucks in your entire graph as soon as you click that button, so the solution to limit permissions after installing the app is just so much closing of the barn door after the horses have left.
