Hey, thanks for sharing your concern.
Though I can confidently say that no one bought it. I mean why even bother, it's open source with 50 lines of code.
Browsing Activity was added for Android support, the relevant commit is here:
https://github.com/27justin/ohmyech/commit/6ce3951900dfb64030e28e097bcaee8913e8ce00
And the tracker for someone asking for Android Support here:
https://github.com/27justin/ohmyech/issues/6

... Though I do agree that asking for browsing activity is suspicious. Granted, I did just add it verbatim according to the documentation, since checking the ECH for each connection does somewhat resemble "tracking" browsing activity.
Might check whether it still works when I drop that permission requirement.