Why can the camera be accessed through third-party browser engines so long as it's in a browser window?

If the browser engine can't be trusted to segregate camera access through a PWA then why is it trusted to segregate it in-app?