App can read/write to External Storage. Any App can read data written to External Storage.

As with data from any untrusted source, you should perform input validation when handling data from external storage.
We strongly recommend that you not store executables or class files on external storage prior to dynamic loading.
If your app does retrieve executable files from external storage,
the files should be signed and cryptographically verified prior to dynamic loading.

We have received reports that some vulnerability
scanning tools interpret the ability for image
picker plugins to read and write to external storage as a threat.

Reading images from local storage is the purpose of these plugins;
this is not a vulnerability.

Apps delete data using file.delete()

When you delete a file using file. delete, only the reference to the file is removed from the file system table.
The file still exists on disk until other data overwrites it, leaving it vulnerable to recovery.