My YC company is a GitHub app [1] and the "act on your behalf" thing is just a really poorly written message for the new (github apps vs oauth apps) apps interface. There's even a hilarious thread on the github forum itself about "act on your behalf" when all it requests is your email and avatar [2]
Ironically the newer apps system does have fine grained permissions, but seems more intrusive because of the strange wording
[2] https://github.community/t/why-does-this-forum-need-permissi...