Not to mention the companion app itself is scraping telemetry data:

• What phone you use

• What network it's connected to

• What times you use your phone

• Approximate location

• A list of other apps you have installed

And that's all before we get into the nitty gritty of how the user actually engages with the app content, or other device permissions the app might request. Maybe "Location" for recommending preheat times based on distance, maybe "Camera" to check doneness, maybe "Nearby devices" to pair with first-party accessories, or maybe "Photos and video" for some shoehorned social media component.

They can ask for any permission for ostensibly innocuous/justified reasons, but once those permissions are granted, they have full access to that data to do whatever else they want with it. They'll know who you are, where you are, when you're there, what you're doing there, and who else you're with.