To establish API access at misskey, we need to send at least three requests and open browser, which is very complex. We eager to use the default permission because less information of API.
I think the misskey developer just focus on UI. The authorisation system is very weaker than Mastodon. I don’t like this and this is the one of the reason I don’t use Misskey as home instance.