What permissions does the email import ask for, and are they different from a mailbox connection?

Yes, importing asks for less. For Google it requests only "Read your Gmail" (read-only) to import messages. For Microsoft it requests "Read your mailbox", "Read shared mailboxes" (for team addresses such as support@ or info@), and "Stay connected in the background" so the import can finish even if you sign out. Unlike a full mailbox connection, the import never asks for permission to send email or modify your mailbox.