The documentation states:
Starting in KITKAT, no permissions are required to read or write to the returned path; it's always accessible to the calling app. This only applies to paths generated for package name of the calling application. To access paths belonging to other packages, WRITE_EXTERNAL_STORAGE and/or READ_EXTERNAL_STORAGE are required.
You will have read/write access to getExternalFilesDir() on Android 4.4+ without requiring any permissions.
I would recommend using a FileProvider if you need to support lower API levels.