The app only ever holds the access you approve and can be revoked in one place. A classic token acts with your full permissions and has to be rotated by hand.
Use one only when an organization has not approved the app yet.
Sign in with GitHub instead.