Let’s not forget all that lovely metadata they can harvest by accessing the camera module, including the exact GPS co-ordinates the picture was taken.