My set up:
Pixel 8, latest GOS version. Admin account with Obtanium -> through obtanium I obtained the fdroid version of threema libre. Installed into secondary account and use it in the secondary only.
Issue:
When trying to send files i could access the whole stock file manager without granting any permissions. In the app itself - it was asking me to set the permissions, but I was able to ignore the prompt (due to ui bug i didn't see it at first) and access the full disk without granting any.
When i set up storage scopes, attaching photos in the ui functions only with the specified scopes, however if i press 'attach file' it opens up stock file manager and has access to full dick again.

I seriously doubt that this is intended behavior as gos whole idea is to have control over what info the app has access to.

    I can confirm this.

    Threema Libre from F-Droid v 5.2.3

    Permissions: Allowed: Camera, Microphone, Nearby Devices, Network, Notifications, Phone.
    Not Allowed: Contacts, Location, Photos and videos, Sensors.

    I can tap "Attach -> File" and still attach a Image from the Downloads folder for example.

    Dumdum Hey, i appreciate the response and the clarification, having recently switched from ios you realize how little you actually know about real permissions and how the operate;)