Because users are authorizing the app, for a seemingly legit purpose, but they are not intentionally authorizing the bundled third party SDK that came along for the ride to exfiltrate all of the data that it can.