They’re not giving direct access to the cameras, but developers don’t need that raw data. Developers still have access to the data the cameras see. The choice to do this probably stems from a security perspective. This way there’s no possible malicious app or site that can actually record you in an intimate environment like your home. It’s the same way ARkit has worked for years on the iphones and ipads.