Rejected Status OAuth question

[RDA]

We are using OAuth for a user to connect their Google Ads Account to our MCC account. The OAuth is not used to login to our application. Is verification not required because of the scope of how we are using OAuth? I received an email from Google Cloud with the below message.

 Since the project: XXXX is in 'Rejected' status it is no longer subject to the 100 user limitation and 

• NOTE: The 100 user cap will only become relevant again if the project: XXXXX requests access to unapproved scopes that require verification (this includes both the codebase of your app and/or scope picker in the OAuth Consent Screen of the Google Cloud Console).

What does this mean? Am I limited to the 100 cap and do I need to get our app verified? Are we limited to the 10,000 per day limit?