http://e26whn2524322mkxb3cbyk27ev2ihhq2biz35hty7gzgsyrwrygq27yd.onion/posts/blog/security/digging-into-the-behaviour-of-a-self-authenticating-mastodon-scraper-bot.html
CA's product was a linked application which claimed to provide some utility, but also used the linked user's privileges to collect/spy on other user's behaviour. Currently, an unscrupulous app could do the same with Mastodon and instance administrators wouldn't even be able to see that it's registered.