When a Notes app (like Google Keep, Wunderlist, Stickynotes) etc asks for permissions to "Photos, Media and Other Files" (PMOF) on your device, the user can get a bit uncertain. So essentially, can the app just ask for Files permission and not Photos,media? Are the permissions defined at such granular level post Android 6.0?
android.permission.[READ|WRITE]_EXTERNAL_STORAGE, which, once granted, allows app to read whole
/sdcard. See this answer for details how this happens at back end. Now the app can read / write / inspect /delete / rename / modify / upload / encrypt whatever you have in shared public storage including photos, videos, documents, contacts, messages, backups and so on.
Unfortunately Android offers no more granular control over this filesystem level access. However Storage Access Framework (SAF) can be used to not let app access whole
/sdcard filesystem, but only a specific file or directory (included subdirectories).
Android Q is introducing a more fine-grained control with Scoped Storage.