> Users might reasonably conclude that When they grant consent, the app – the 3rd party computer software – would be able to read their email, but no human would be able to read their email.

Users can reasonably conclude that, because of the very poor state of user privacy knowledge, but they are still incorrect. It's rare the third party that can add something useful to a web application which doesn't also necessitate the same privileges that would allow data exfoliation, and which isn't usually added by the first party developer fairly quickly.

Education is needed here.