They shouldn't allow apps to give themselves permissions without an OS generated confirmation dialog. Google figured this out years ago

They can't. You have to explicitly give apps permission to access your photo library.