Permission scope
Why it matters for creators
Scopes are what turn "this app has access to my Instagram" into something you can actually evaluate, because they are the itemised version of that sentence.
The screen you tap through when connecting a tool is the list, and it is worth reading rather than dismissing. A comment-to-DM tool genuinely needs to read comments and send messages. If the same tool also asks to manage your ads or read your page's business data, those are separate abilities that its stated purpose does not require, and asking why is reasonable.
The narrower principle cuts both ways, and it is one we apply to ourselves: inDM deliberately never requested the insights permission, which is why story views and audience geography are hidden in the product rather than shown as zeros. Not taking a permission means genuinely not having the data. A tool showing you a metric it has no scope for is getting it from somewhere else.