Security model when asking access to photo, media and files

When an app asks for permission to access photo, media an files, does the andriod security model sandbox the access to only files for that particular app? Or can the app then access files created by other apps? So many apps ask for permission to the file system, does that mean e.g. App#1 can grab files created by App#2? I want to install WeChat but want to understand what security risk is involved potentially.