Confused about PHPicker's privacy

1. In my app, I'm able to create a PHPickerViewController instance and present it. The picker displays all photos in my photo library, even though no access permission is granted. Is this expected?

Yes this is expected. As explained in the video that you linked at https://developer.apple.com/videos/play/wwdc2020/10652/?time=70, the picker runs out of process, so your app will only receive the content that the user selects.

2. When I selected photos and received their assetIdentifier, I tried fetching the corresponding PHAsset(My app needs PHAsset. A UIImage won't be enough), only to get a PHUnauthorizedFetchResult. So apparently I still need to prompt for access permission in order to fetch the PHAsset. This is not aligned with this intro video https://developer.apple.com/videos/play/wwdc2020/10652 where it claims this picker "Won't prompt for photo library access". Am I doing something wrong?

This is also expected behavior which is explained in the video at https://developer.apple.com/videos/play/wwdc2020/10652/?time=633