There are a lot of more or less abandoned or dormant services out there that once promised to analyse your "reach" on the fediverse or services that promised automation for posts that you once tried (thus giving them authorisation to post toots) and forgot about. But that token remains. And if someone buys/hacks such a service, they might get access to these tokens and boom. So make it a habit to check which apps/services you've authorised and revoke those tokens when not needed!