Not really, it's a limitation Spotify has to deal with if they want to offer 'services' which require these permissions. Access to photos is not needed to stream music, last time I checked ;)

That Android has 'one-ticket-for-everything-LOL' security flags is sad, but that doesn't mean Spotify then thus has the responsibility to work with that and if they are so serious regarding privacy of their users, offer a way to make me control what they can see / do, however I can't: at install I have to give permissions and after that I can't control what they can see / do or not, not in the app, not in my account, nowhere. I just have to trust them.

That last part is a bit difficult at the moment.