> Why did nothing ask me if I was ok giving Facebook access to my hardware?

I'll let you in on a secret: Facebook is also controlling your graphics card, and CPU, and memory. Controlling as in "sending HTML that is then displayed via those hardware components".

And just like a media query can "access" your device orientation, panoramic media can adapt to the data from accelerometers.

The missing information here is the concept of "secure contexts": https://w3c.github.io/webappsec-secure-contexts/#intro. Being able to use this data does not mean that it can be send back to the server.