I'm not sure if this is an issue with Google Docs or Drive, or whether it's the result of an API call made within the script (other than the replacement of text, I couldn't find anything "destructive"), but the permissions that the user needs to grant the script seem overly broad for code that's intended to create one document from another (see image).
Yeah, I'm not sure how it figures out the permissions - I think this is an issue of it being a script embedded in the doc so it can basically do anything :/
I'm not sure if this is an issue with Google Docs or Drive, or whether it's the result of an API call made within the script (other than the replacement of text, I couldn't find anything "destructive"), but the permissions that the user needs to grant the script seem overly broad for code that's intended to create one document from another (see image).