Tim Panton on Nostr: from my (distant) memory of the standards discussion here, the id in question is only ...

from my (distant) memory of the standards discussion here, the id in question is only available to the javascript _after_ the user has granted camera or mic access. It is used by sites to allow a user to persist their preferred choice of media device across visits. The assumption is that users won’t grant camera permission to an untrusted site.