Not sure about Android, but at least on iOS, you aren't prompted to allow access to photos until the you attempt to use the feature in most cases, which is what Spotify are arguing for here. But you're right, once you've granted permission it's up to the app to be responsible.

Makes me think the OS should provide a 'Just this once' button when being asked to allow access to extra permissions.

That would be nice. Otherwise, soon I'll need to use a "throw-away" phone just for the apps since most of them usually require more permissions than I'd like to share.

True, it's really more of an Android issue, than a Spotify issue.

Not really, it's a limitation Spotify has to deal with if they want to offer 'services' which require these permissions. Access to photos is not needed to stream music, last time I checked ;)

That Android has 'one-ticket-for-everything-LOL' security flags is sad, but that doesn't mean Spotify then thus has the responsibility to work with that and if they are so serious regarding privacy of their users, offer a way to make me control what they can see / do, however I can't: at install I have to give permissions and after that I can't control what they can see / do or not, not in the app, not in my account, nowhere. I just have to trust them.

That last part is a bit difficult at the moment.