Read-only site access is a weaker control than the panel makes it look, because the extension still runs its content script and can read what's on the page while it's there; the permission just decides whether it gets to keep talking to that tab afterwards. And the setting doesn't cover VPN and proxy access at all, so someone can tighten it, see the workflow pass and conclude the extension is boxed in when it isn't. Narrower is worth doing, but it's worth being clear-eyed about what it buys.