@felix.herrmann just understand this:

Each application created through SteemConnect is a separate Steem account managed by both owner and steem connect.

The high privileges are necessary at the approval moment because of this:

SteemConnect will update your account, enabling the application itself to be 3rd party poster in your behalf.

The applications are usually suffixed with a .app name because only SteemConnect control the application key.

When then, the app posts in your name, it's NOT Your posting key being used to sign, but the application posting key, which only SteemConnect knows.

This makes the application posting on your name, only possible though SteemConnect and the permission you gave the application can be revoked at any time.