Steemconnect generates a token for the app that has the same permissions as the posting key, but to do that it needs the active authority once since the posting authority does not have permission to generate auth tokens. It can not be possible to log in to a new app without using the active key once.

App owners never get access to the active key, just to the tokens with the posting authority, so it's pretty save - unless there are phishing sites imposing steemconnect, steemconnect itself would be hacked and replaced by a phishing website or the user system was compromised (clipboard spyware, malicious browser extensions etc.)