If you install an add-in, or an app, and it wants to read any of your stuff managed by google (emails, drive contents, calendar, etc) the app must request user consent. This user experience is well known and understood. The user must sign in and then also grant consent specifically to the app in question. If the user grants consent for the app to “read email” then the app will be able to read your inbox.
The article is saying that _humans_ employed with the 3rd party app development company are also able to see your email.
Users might reasonably conclude that When they grant consent, the app – the 3rd party computer software – would be able to read their email, but no human would be able to read their email. Well it turns out, once the app has consent, the app, if its designers make it so, could read your email and then save your email elsewhere. And then humans could read the contents of that email elsewhere.
The article is saying that _humans_ employed with the 3rd party app development company are also able to see your email.
Users might reasonably conclude that When they grant consent, the app – the 3rd party computer software – would be able to read their email, but no human would be able to read their email. Well it turns out, once the app has consent, the app, if its designers make it so, could read your email and then save your email elsewhere. And then humans could read the contents of that email elsewhere.