This is unfortunately the expected - though not the "correct" - behavior, at the moment. 
Our HubSpot app is configured with just the one allowed scope, which is almost certainly a bug or oversight. I've re-escalated this to the team and should hopefully have an update soon.
In the meantime, at least, there are alternative authentication methods that I've alluded to or described above. Let me know if you have any questions!