I also disabled Photos access in the Damus settings for testing, and the image picker still shows up with my entire Library visible and available.
How does this even work technically?
I always assumed Apple had provisions in the API to prevent this. Do app permission work entirely on a good faith, voluntarily level?
That would make me pretty concerned.