How are they limited
Using OAuth, you ask for scopes, which are similar to permissions, this means they can only use the credentials for what they ask for, and cannot do things that are out of scope.
Some of the scopes do cover multiple things though, for example being able to copy an email means they can also read the email, which is not something that OAuth could defend against unless Gmail provided an encrypted access scope, but then if Gmail disappeared so would the decryption keys.
The benefits of using OAuth are:
- You can revoke one app without revoking all of them
- You can change your password without losing your apps
- You can limit what apps do
- Apps need to explicitly ask for scopes, so they can't escalate permissions
What do they ask for
Visually

Behind the scenes
Using data from the docs and a test login I found the following scopes are requested
email
View your email address
profile
View your basic profile info
https://mail.google.com/
Read, send, delete, and manage your email
https://www.googleapis.com/auth/drive
View and manage the files in your Google Drive
https://picasaweb.google.com/data/
This appears to be an old scope: Info
https://www.googleapis.com/auth/calendar
Manage your calendars
https://www.google.com/m8/feeds/
Manage your contacts
https://www.googleapis.com/auth/tasks
Manage your tasks
Conclusion
As you can see above, they ask for a lot of permissions, in theory, they could get away with the read-only variants of the above, but they may allow you to push data back to your account, which requires being able to write.