> I thought they had introduced a "get a single photo for this app without photos permission" picker (I'm pretty sure I've used it in apps!) but I can't find any indication I'm not wildly hallucinating.

It exists (https://developer.apple.com/documentation/uikit/uiimagepicke...) but apps don’t want to use it.