Think the issue is, practically speaking, we don’t have a good track record of modeling precisely where the camera feed goes to decide if it is stored or not. Mobile OSes do present a more sophisticated permission structure that gets closer, but things are still too flexible to really comfortably assure that nothing that was a party to the feed didn’t somehow store it.