If I'm right the app permission only are to buy, sell and view balance.
It is clear as day that what the member is claiming is that the app pumped and dumped his balance using a low volume coin .
with access to a few accounts you can exactly steal their money without having to withdrawal, i have always warned against the use of trading bots and APIs for this exact reason.
Is it possible to further clarify the idea of theft without the need to withdraw the balance