Originally sc didn't require sharing permissions,the signing happened in your browser.
When steemit took it over they decided to use the shared authority. (That's v2. They're still keeping v1 available right now, I hope for a long time). From a certain perspective it also makes sense. But it's up to the users to keep their auth list clean now, and having visible which authorites were used to sign the transaction would be very useful.