Obviously bad permissions are bad. But "sign-up with email" means that you need to manage you users identities which is complex and risky. You can delegate that using something like Auth0 but then it costs you money.
If I am creating a new service today I will probably won't bother and just offer social logins.
If I am creating a new service today I will probably won't bother and just offer social logins.