Who can spend your tokens.

Approval events from your address, over the whole chain, are only leads: any contract can emit one. Each lead is confirmed with a fresh allowance() or isApprovedForAll() call on the token before it is listed, and every revoke is simulated before your wallet sees it.