Even though the accepted answer is 100% correct. I think it’s worth pointing out that why that’s the case.
When you authorize a gmail service client, you can specify several different scopes: All, compose, labels, etc…
These are all listed here: https://developers.google.com/gmail/api/auth/scopes
The scope mentioned in the answer provides complete gmail access.