But they don't have to ask for access to all your pictures. You can ask Android to show the standard picker, get the one picture you've selected and that's it.
Or you can do it the way FB does it, by asking for permission to access all your pictures and build your own non-standard picker...
Unless you can audit the code, or someone you trust has, who knows what our devices are doing.