Maybe you allow the external app to access Fullcontrol on your SharePoint. Full Control enables users to have full control of the website (All permissions).
The external sharing features of Microsoft SharePoint let users in your organization share content with people outside the organization
(such as partners, vendors, clients, or customers).
This link may help you bro.
-https://learn.microsoft.com/en-us/sharepoint/sites/user-permissions-and-permission-levels
-https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview