We asked for the smallest scope on purpose.
OAuth scopes requested
https://www.googleapis.com/auth/gmail.sendopenidemailprofile
Not requested, and never will be
gmail.readonlygmail.modifygmail.metadata
Your refresh token is AES-256-GCM encrypted, and you can revoke it from Google any time.