App has photo access, but I never allowed it to access photos I have a to do list app installed that allows you to add a profile photo. I added the image without ever being asked for access to my photos. 

To my understanding, apps that can view your photos should be listed under settings / privacy / photos. This particular app isn’t listed there, what is going on?
Apps with photos access can access all photos in you library whenever the app chooses to in the background without your future confirmation, and can save pictures to the library.

Without photos access, the app can still ask the OS to get the user to choose a picture, at which point iOS can show a system-wide photo chooser and you can choose a single photo. Once you've chosen the photo, just that specific photo is provided by iOS back to the app.