I've used the GH API extensively, and this is a common misconception. The default (no scope) allows you to access public repository info (source:
https://developer.github.com/apps/building-oauth-apps/unders...).
This GH app, for instance, received similar feedback and its author removed the offending scopes without losing functionality: https://news.ycombinator.com/item?id=11261953
