(this issue is from the review I did as part of PING's HR review)
The values returned in getPhotoCapabilities include additional details about hardware capabilities (and, possibly, configuration). I realize that these are protected from passive access through permissions earlier in the pipeline, but this additional fingerprinting surface should still be marked as fingerprinting relevant in the spec as described in https://w3c.github.io/fingerprinting-guidance/#mark-fingerprinting