Shade
If you dont trust it, but need it,
you could also install the google camera app in a serperate profil (and google play services i assume, if they are needed). And then disable all not nessary permissions for these apps.
Assuming non of the system provided apps have an ipc api that allows for secretly sending data per Inter-Process-Communictation,
then it should be impossible for the app to communicate with anything outside of this profile/ on the internet.
(and disabling vanadium/ its network access in case of opening links)
You can then send yourself the data encrypted with the inter-profile-communication app, in the accrescant app store
(the camera app shluld then need to have an exploit to escape its sandbox, which is not realistic)
you could even further try to migiate against that, by only using this when offline (airplane mode, no sim card or even deleting wlan) keeping it at rest when not used etc.
Shade good to know you tell me it has not reports
i mean i am just some guy that never heard about anything like that, so keep that in mind