Most modern mobile operating systems have permission control, meaning it can’t just access everything on your phone. Access to your files, photos, camera, mic, location, and etc. can be controlled by your phone’s settings. However, there are things that cannot be controlled. Many sensors do no require special permissions to access, orientation, gyroscope, accelerometer. Device ID like imei and serial numbers may be accessible, depending on your os. Now I’ve never heard of Wechat having malicious code, but if it does, it could gain unauthorized access to your device data. Apps stores tend to not allow malware on their platforms so the Google Play and Apple Appstore versions are probably not malware, but it can become spyware if you grant it enough permissions.

Edit: Also, Wechat requires internet access to work, so any data you input can be accessible to the company. Now Wechat is owned by Tencent, a Chinese company. China is infamous for requiring companies to share data with the government. So everything you send through the app can be assumed to be in the hands of the government of China