I've seen a lot of apps that have media / files permission access requested when installing from Play Store.
Does that mean they can go at my personal photos and send it back to themselves?
Sorry if it's a bit paranoid but I don't like people stealing my photos.
Yes, this is the "Access external storage" permission which gives apps access to access your internal and/or external /sdcard space. Your photos are typical stored under /sdcard/DCIM/ or /sdcard/Photos/, etc.
As explained here:
Photos/Media/Files
The Modifying or deleting the contents of your USB storage permission allows data tomfoolery, like uploading private camera images to a server.
It’s a legitimate permission for data sharing. A cloud storage app like Dropbox uses it, for example. But an app that doesn't need your photos could look at all the pictures you've taken on your device and do who knows what with them. Are you comfortable with the developer seeing all your photos?
Q & A