The revoke access link doesn't ask the user to confirm that they want to revoke the access. While for things like geordi it's trivial to re-authorise it, it would be more annoying for desktop apps where you have to copy and paste tokens between programs. It also doesn't even tell you that it's been revoked, so if you accidentally click, you might not even notice that something changed (think cat jumping onto a laptop, etc).