How does this even work? The iOS pop-up should have priority over any attempts for the app to block pressing areas of the screen.
This is not just possible, it's actually extremely easy to do.
Hoping to share a proof of concept soon.
It’s not more unacceptable for an exploit to exist than it is for the exploit to be used. One is a risk, the other is actively attempting to do harm.
This should be the case for all such interactions, including permissions, image library selection etc.
I realize APIs are hard to change but this is one of the cases where I think Apple should just fix it even if it bricks well-behaved apps until they can be patched (which could be never).