Hanna I believe an app can create a file, in the location it chooses. It will only have access or be able to see that file if it is created outside of the storage scopes you have set.
Please forgive me if I am incorrect but off the top of my head, I believe this is how it works
Edit: I'm not sure if I explained that well. Basically, the app can create a file outside the set storage scopes, but that does not mean it can access or see any other files in that folder, unless that file was also created by the app in question.
A great part of storage scopes is that they make the app think it has full file access. However, it can only see what you give access to, or what it creates (if this was not the case, it could break app functionality if the app couldn't create a file or folder where it usually does)