They absolutely can. It’s a bit messy but it can be done. It revokes all API access including the first party app. Chat back and ask for it to be escalated to TechSpecs (Technical Specialists).
I do agree there should be something far more granular and user facing. I think it’s coming tho,