YES.
> I understand they were using a very broad wildcard for permission on websites they could access
That is a problem.