Glossary
Microsoft Graph
Microsoft Graph is the single API through which applications reach Microsoft 365 data: users, groups, mail, calendars, files and SharePoint sites. Permissions to it are what decide how much of your organisation an application can see.
In a security review, the resource named in a permission request is what matters. A request against Microsoft Graph reaches your data; a request against a vendor's own API does not, however similar the two look on screen.
Read the suffix too: .All means tenant-wide, not what the current user can see. A component whose job is to render a table on one page rarely has a good reason to want tenant-wide Graph scopes.