> a big difference between me enabling an app to use my data for the service I believe it provides and them using it for everything else.

Making this distinction a legal requirement was a very important part of the GDPR.