> why they can get a list of audio and video input devices without asking to use them first

I don't think they can do this without audio/video permissions (?)