The spo site apppermission add and spo site apppermission set commands contain the following description for the --permission option:

Permission to site (read, write, read,write). If multiple permissions have to be granted, they have to be comma separated ex. read,write

It seems that this is in fact incorrect. You either use read or write. The write permission includes the read permission automatically.

Also see the PnP PowerShell equivalent Grant-PnPAzureADAppSitePermission here.

Also, the PnP PowerShell commandlet Set-PnPAzureADAppSitePermission allows to update the permissions to manage or fullcontrol as well.

It would be awesome if we would fix this and expand it at the same time.