Yeah, the current versions of Android and iOS already mitigate this by allowing you to select just a few photos to give permission.

But if you think about it, most users don’t really understand this permission thing. They think it is an app thing, not an OS thing. Many times I’ve seen people online ask “what prevents the app from saying X and doing Y?”.

I think apps should never get permission to the whole user library, and any permissions given should be temporary.