@SameGirlie When you authenticate you do so on the Twitter website itself (you can check that by looking in the address bar, it says ‘api.twitter.com’). What happens then is that Twitter creates a kind of one-time password that gets handed to the app, e.g. Debirdify or Fedifinder. Twitter tells you what this one-time password is good for, e.g. Debirdify/Fedifinder request read-only access.
This means that they can use that password to read your tweets, timeline, lists, followers, etc. They cannot read your DMs and they cannot change anything, write tweets in your name, etc. But in principle they *could* look at your private lists, the people you blocked, etc. and save that information somewhere, email it to someone, etc. But that's the worst they could potentially do.
Also note that you can revoke the access immediately after using the app in your Twitter settings.