> I don't get asked about access for Chrome at every update.

Is it possible that you clicked "Approve" while the parent clicked "Not now"?

One of my personal issues is that I was using software called "Secretive" which installed a Secretive Agent system service. I later patched and forked it, but reused the name. Despite the app bundle ID being different, and having a different signer, they show up collapsed in the "Login items" panel, with no way to enable one and disable the other: https://i.servepic.com/t5DvVjB0.png

There are also numerous entries for software that has been completely removed from my system for years. I wholeheartedly believe OP's experience.