They’re not giving direct access to the cameras, but developers don’t need that raw data. Developers still have access to the data the cameras see. The choice to do this probably stems from a security perspective. This way there’s no possible malicious app or site that can actually record you in an intimate environment like your home. It’s the same way ARkit has worked for years on the iphones and ipads.

I’ve actually had the exact opposite experience. My contact has been all sorts of buggy for years and the new Contact Card has been rock solid for me. Always interesting seeing the variations of bugs in beta/prod