Hi,
I'll copy paste my answer on Github and upvote for better visibility:

To function, Hive Keychain needs to inject code into dApps so that these dApps can make requests back to Keychain.
That s what make it possible to login, vote, transfer etc. via Keychain.
Since new dApps are popping up all the time, we can't maintain a list of whitelisted dApps and are instead injecting this code in every page.