A solution would be that Apple builds a privacy preserving picker in the OS, then mandates apps use it instead of giving them access to the camera roll and letting them roll their own pickers in the first place.
there is already one, the enforcement point is what's missing