How do you give them approval or permission? How do you know that you have given them permission?
Your approval is done manually and according to your decision (
example). This approval will be done when you decide to swap the token you got with another token. Every time you get a new smart contract in your wallet, you are required to do it for approval. that's when the smart contract is created to steal tokens from the wallet, the contract can execute without asking for your permission.