The app owner is always given the token. And besides, the app doesn't even need the users token in order to access the money. (It can directly access it itself). Only put what you are willing to trust in an app (as it's clear by the warnings)

Although the important thing to note, is if you put X in an app, the app can steal up to X. But it can never undetectably do so. i.e. It can never rig the bets. But it can bet without you authorizing it to. And it can transfer without you authorizing it to.  However, if it does nasty stuff like that, at least you'll know it. (But you'll still lose your money).