T290790: Group OAuth grants by riskiness indicates to users that including admin-level permissions in their app requests make them less likely to be approved. Unfortunately, ApiPortal has its own implementation of requesting new OAuth 2 apps, and there are no warnings there, so we get lots of requests with "Edit protected pages" checked (for some reason, the only advanced grant available via that interfaces), which are then often rejected, a waste of time for everyone involved.

Since the idea behind Special:AppManagement is to have a simple, minimal UI for the most common OAuth 2 use cases, and editing protected pages is very decidedly not a common use case, I think the easiest thing to do would be to just remove that grant option (and maybe add a link to Special:OAuthConsumerRegistration for more complex use cases).