> I think it's clear consent was given at some point

That's not what was found. I don't know the facts of the case, but it's possible that "consent" mechanisms were found to be insufficient. As an example, if you ask for permission for one purpose, then use it for another, that would probably not meet the "inform users" bar.

Giving access to photos so that the user can upload a photo is not giving consent to analyze all the photos of the user on a phone.

The main principle of the GDPR is to store and use as little private data as possible and only get/store data when the user explicitly asks for it/consents to it.

(IANAL of course.)