Privacy concern with capture attribute

[LJWatson]

Originally filed by email from Nick Doty, in response to a wide review request to the Privacy IG.

There are some nice privacy advantages to using this model of user-directed input for camera access and it's nice to see that reflected in the HTML spec.

The capture attribute is defined in the html-media-capture specification. Implementors should note the requirements on user agents defined in that
specification have security and privacy implications.

The grammar is a little ambiguous here, but it sounds like this is intended to parse as "implementors should note that the requirements on user agents
have security and privacy implications". 

The Media Capture spec's Security and privacy considerations section is non-normative; it explicitly doesn't add those as normative requirements on the
UA. Perhaps it should; the advice about stripping invisible, sensitive metadata (the example is EXIF data, which might include geolocation) seems especially
important.

There are privacy implications to other requirements in that spec. For example, the UA is forbidden from saving captured media to storage, which seems
like a privacy advantage, although I could imagine some abuse or violation of user preferences from that requirement.

Is this just a general reminder to implementers that they should consider security and privacy when implementing this other specification? Could we provide
something more substantive or is the group just looking to hint at unspecified privacy implications?