iPhone: Game app able to access Photos without permission

The app in question is presenting a system provided UIImagePickerController to choose image for setting as user's profile picture.

From the PhotoKit Apple Developer documentation, Requesting Authorization to Access Photos:

When using the UIImagePickerController to bring up the user's photo library, your app doesn't need to request permission explicitly.

This behavior is by design since iOS 11. UIImagePickerController runs in a separate process from the app, and doesn't directly get to read the Photo gallery data. Thus, for read only access to photos, no special permission is required.

This explains why you don't get the see an alert seeking permission to Photos, and the same isn't displayed under app preferences in Settings app. The user is explicitly setting the picture and the app couldn't read the Photo gallery directly.