Now with iOS devices having Face ID, there are potentially 3 cameras. But there is only 1 access permission for "Camera" in the Privacy settings.
Well-Behaved apps use the camera in conjunction with an on-screen viewfinder of sorts to let you know what the app is going to capture.
Comments on this old question imply that apps can capture images at any time. Clearly now that at least requires access permission.
Assuming a non-jailbroken device with "Camera" access granted to the app, can that app take stills or video with the front camera, back camera, and / or the TrueDepth (Face ID) camera, without making the user aware?
For example, can an app surreptitiously take a selfie of you while you are using the app to take a picture with the back camera? Or can an app use any camera without showing you any kind of viewfinder of what the app can "see", or without any indicator at all that it is capturing imagery and potentially transmitting it to the app maker or an app-embedded 3rd-party?
You can put a sticker over the front camera of any iOS device, including those with TrueDepth, but you can't cover the TrueDepth camera if you want to use Face ID for authentication. Given the potential sensitivity of the TrueDepth data, this is concerning.