While I'm sure this is probably true, the number of features Apple is depriving us from due to alleged "security reasons" is baffling.
It's a general excuse among firms that want to keep their monopoly and walled garden (OpenAI does the same).
Having a separate API for photo access is annoying while developing this use case, but it's appropriate for a couple different reasons: for one, if apps could access the raw files, that could reveal metadata like location. For another, filesystem access wouldn't properly handle cloud-synced photo libraries.
Perhaps photos on iOS are persisted into some sqlite-style database on the device rather than as individual files...
The Dropbox iOS app would be a good example here. It acts as a ReplicatedFileProvider so apps on the device can access your Dropbox files, but it also provides an optional config flow where users can ask for their photos to be backed up. Then, the Dropbox app fetches the photos through PhotoKit and writes the .JPEGs or .HEICs to a folder of your choosing into your Dropbox files.
If you don't use the photos app, you can keep them all in the files app and it syncs just fine. Annoying to use since the files app is nowhere near as nice for photo browsing/management.