If there's no setting in the iOS Settings app to take away the camera permission (which isn't even given by default and the app has to ask for it), it can't access the camera (unless it exploits a potential vulnerability in iOS, which I highly doubt).
It probably used data from motion sensors and the reason you saw your room was because of the glossy display. Or you have allowed the YouTube app to access your camera.