The access to the camera is managed by the web browser and is not managed by the VTO module.
The general policy of web browsers is to request the user to give access to the camera when visiting a website for the first time and then store it for subsequent visits. This access right is generally managed on a per-website basis, meaning that users will be prompted to give access rights for each different websites requesting access to the camera.
However, the policy can vary depending on browsers and on operating systems (OS), especially on mobile phones (Android and iOS).
Safari's policy on iOS is to not store the right by default, meaning that the user will be prompted to give access every time, even on the same website. However, users can manually choose to allow permanent access to a website from Safari settings.