>How exactly would that work without the app having access to the pictures?

Extremely simple: the photo picker is part of the OS and not the app, so the app can open it and wait for return file handles without knowing a thing about what the file browser will display