A valid concern for sure! The tokens we store are all encrypted, but you can also revoke them easily on Google's OAuth screens if god forbid we were to have a breach. I believe we can also revoke all tokens by refreshing our own Google OAuth keys.
Regarding the unsubscribe within Gmail, I can't vouch for exactly how that button works, but there are three methods that are possible.
1. Subscription services can specify in the email headers that they have "one-click" unsub functionality. In which case following the link should unsubscribe you.
2. They can also specify an email address, and sending an email to should unsubscribe you (you can check this by clicking the button and then checking your sent emails).
3. They can also just specify a regular unsub link. This usually requires you to input additional info such as your email address, or a reason for unsubscribing. I don't think that Gmail will be unsubscribing you from these, and they are probably the most frequent.
Leave Me Alone will try all of these methods to unsubscribe you, including filling out any forms if required.
It will also show you all of your subscription emails in one place, which I don't think is possible from within Gmail.