the camera will have small defects and foriegn objects that we cant see but are very detectable, thus similar to a fingerprint. if you read the wall of legalese regarding permissions there is likely some language that is being interpreted as tacit permission.

this is nothing new, the camera doesnt even need to be on long enough to generate an image just long enough to initialize and reveal its distinctiveness, and yes your right it shouldnt be needed by you, but it[camera] and other sensors are used by many apps and services

It could well be that it's not asking for camera permissions. It's just fingerprinting whatever hardware is connected, and one of them just happens to be the camera.