Hmm. I couldn't find an indication of whether this requires Secure Context (ie only works with HTTPS or localhost) ?
Secure Context seems (coupled with the permission check) like it's an appropriate requirement here but I didn't see whether it's actually enforced, and obviously as an HTML attribute rather than say a Javascript API it might have been forgotten.
Secure context has never applied for form data and i see no reason why it would here.
If it's acceptable to send the picture as a file upload over http then i see no reason why it wouldn't be acceptable to send a webcam captured picture.
Secure Context seems (coupled with the permission check) like it's an appropriate requirement here but I didn't see whether it's actually enforced, and obviously as an HTML attribute rather than say a Javascript API it might have been forgotten.