Scopes do get overwritten. Instead of changing scopes as users require them, I have opted to request what I need from the start. This makes it more simple in the case where you need to reauthorize accounts (due to issues out of your control, like a user revoking permission from the “Connections” page or Twitch’s security breach where everyone’s access tokens expired).