[0] https://developer.twitter.com/en/docs/basics/authentication/...
has two options for doing it without granting any permissions to a third party
I have no idea, why they do not offer a global show/hide retweets option. If you follow a couple of hundred accounts—like I do—having retweets enabled pretty much ruins your entire timeline.
Because it's in their interest to show you as much content as possible. Just guessing.
The app also does not save the access tokens it gets back from twitter. They get thrown in a background job to be worked on, and once the job is done the access tokens are forgotten.