That's not true. It bypasses the default security model but it is entirely possible (and to be honest I'm surprised there hasn't been progress) for the user (or the compositor automatically) to provide an API that provides the required access to whitelisted applications.

It is just like the web. By default websites don't get to access your camera, but that doesn't mean that camera access is impossible. They just added a way to request camera access with user permission.