Hey, welcome to the forums!
I understand the tendency to assume that if it can access information, that it does. But as it has been explained to me, developers often need to include permissions in apps we as end users may not understand, or even the devs don't want, but due to the structure of the OS, need to to make the app functional.
Gtasks for example I'm sure gains "access" to pretty much all of my google account information because it is syncing with a part of my google account. I really don't think they are accessing all the available information, but need the "permissions" to have access to the tasks and syncing.
I would think one would be very hard pressed to find an app that syncs your google tasks that doesn't need "permissions" to things we as users think are unnecessary. That doesn't mean they are unnecessary though.
Good thing to be aware of though. I tend to stick to apps that are well known and widely used so that if something does come up about them doing something nefarious, it will come out.
The only app I remember seeing not require some permissions was a flashlight app or something uber-simple like that.
Thanks for the tip on the ZAP Zscaler web site. I'll be checking that out!