staff memeber can install apps even if have limitied access

How it was found

hey ; for example staff member have limit access to orders when this memeber want install app (scope read_orders) ,error message showed :

Oauth error invalid_request: You do not have permission to access the requested scopes

bug:

staff memeber can install app even if have limit access to scops https://youtu.be/AoFLfiDDUog