Yeh that's unfortuante but it is normal for box's API. This isn't Google being overly grabby, its the only scope available to third party read and writing to box.

The API scope doesn't have any knowledge of individual files or applications. https://developer.box.com/docs/scopes

Conversely, Google Drive does have scopes available for Application specific folder read/write https://developers.google.com/drive/api/v3/appdata

So box needs to up its game.