I agree that there are legitimate reasons for these permissions, I just don't think they match up with everyone's use case for the product. This is why they should be split into plugins.
Example of how the UX for this works:
1. User chooses "attach photo."
2. If user has not installed the plugin, Signal gives them an informational prompt and a button that opens the app store link.
3. User clicks the button to go to the app store.
4. User clicks "install." Application is installed (should be quick, small app)
5. User can now attach photos from external storage.
Steps 2-4 are short and occur only one time. You would not want this kind of extra friction in a true mass market app, but I'd argue that Signal is not and never will be mass-market. (We can hope, but it's not likely.) Signal's target users, on the other hand, would be likely to appreciate this extra focus on security and user control.
Example of how the UX for this works:
1. User chooses "attach photo."
2. If user has not installed the plugin, Signal gives them an informational prompt and a button that opens the app store link.
3. User clicks the button to go to the app store.
4. User clicks "install." Application is installed (should be quick, small app)
5. User can now attach photos from external storage.
Steps 2-4 are short and occur only one time. You would not want this kind of extra friction in a true mass market app, but I'd argue that Signal is not and never will be mass-market. (We can hope, but it's not likely.) Signal's target users, on the other hand, would be likely to appreciate this extra focus on security and user control.