The Ephemeral Rooms addon doesn't do anything fishy with your data. Below is a list of the scopes required by the addon along with an explanation of why it needs each scope.

manage_rooms

This scope is required to create and delete rooms. Ephemeral Rooms does both of these things: when it receives the /quickchat command it creates a room; and when all participants leave a room it deletes the room.

view_room

This scopes is required to query for information about a room, including how many participants are in it. Ephemeral Rooms listens for a webhook whenever someone leaves a room; if it's an ephemeral room (one created by the addon), it needs to check to make sure no one is in the room before deleting it.

admin_room

Ephemeral Rooms creates a private room when the /quickchat command is invoked; it needs the admin_room scope to grant users access to this room.

send_notification

To invite all @-mentioned users into a room, Ephemeral Rooms posts a notification into the room inviting said users after it's been created. This requires the send_notification scope.