Does anything stop an application with Photos/Media/Files and Other ("full network access" and "run at startup") permissions from simply uploading ALL of your photos and videos to some stupid server they control?
Is it access to store and read their own photos/files, or total access to everything on the phone? Does it matter if it's on an SD card or internal storage?