Are you sure Faceapp grabs only the photo you uploaded? “At most” implies it literally can’t grab more than that. But it seems like it can. It has access to all your photos, not just your camera.
Edit: Obligatory “why are you booing me, I’m right?”
We have seen lots of examples of ad analytics SDKs that push the iPhone beyond its intended sandbox. Most of them have been banned, but some operated for years before getting banned. It would be a disservice to brush away those concerns as fearmongering.