I'm pretty sure the sites you're thinking of are open IP cameras, not behind firewalls rather than rooted machines. I know Flash has always required confirmatio

I'm pretty sure the sites you're thinking of are open IP cameras, not behind firewalls rather than rooted machines. I know Flash has always required confirmation for webcam/microphone, whereas a local app doesn't need these permissions (excluding the possibility of a flash exploit).