Okay, it's wider than just GMail, I had missed the addition of Drive, but according to that link an audit is just required for
> Drive - Any Drive API scope that permits an application to read, modify, or manage the content or metadata of a user’s Drive files, without the user individually granting file-by-file access.
I could be wrong, but to me this suggests you can use the Sheets API against a user-specified document without it. It has it's own namespace of scopes that's not under drive.X
> Drive - Any Drive API scope that permits an application to read, modify, or manage the content or metadata of a user’s Drive files, without the user individually granting file-by-file access.
I could be wrong, but to me this suggests you can use the Sheets API against a user-specified document without it. It has it's own namespace of scopes that's not under drive.X