It seems like add-ons are still mostly Ok if they use the narrowly defined scopes, instead of say "gmail.readonly" which is a blanket permission. Minor heart attack, but we might be ok.