Indeed, there is an option in the settings that will not download any media unless you authorize it. It also creates its own media gallery, which you can periodically delete photos from. In this regard it's not much different from other messaging apps, but yeah absolutely tick that permission off. If you use it for work in group chats you are probably getting flooded with work related photos that aren't even addressed to you, as it happened to me.
Another one you may find useful is removing the automatic backups to cloud. They pretty much brick your phone at 2am or whenever the hell it chooses to do it.