This API does not implicitly give access to the camera or photos. The things that you are concerned about are already possible by doing the NN part server-side, or less efficently in software. If anything, keeping the NN part on the client allows for more privacy, not less.