Yes, a script from Google Apps Script on any Google Workspace Editor (Docs, Forms, Slides, Sheets) or any other place can access all your Google Drive files if they have requested the corresponding permission and you authorized the script to run.
The authorization technology is called OAuth. It handles permissions through OAuth scopes; the scope that allows the script to access all the user Google Drive files is https://www.googleapis.com/auth/drive
Reference
- https://developers.google.com/apps-script/guides/services/authorization
- https://developers.google.com/identity/protocols/oauth2/scopes
You might not remember it, but when a script that requires authorization is ran for first time it asks the user to review the permissions required by showing a OAuth consent screen. This screen shows a list of all the required permissions including links to the description of each of them. What you are seeing on the Google Account security checkup page matches what was shown in the OAuth consent screen.
If the script is changed to add more permissions that was previously authorized by the user, the next time that the scrip is ran a new request to review the required permissions will shown, if the new permissions aren't authorized, then the script will not run.
If you don't trust the script author the best is to remove the authorization.
Related
Related discussion on official Google Apps Script Community