there should just be an extra layer of authetication if the feature can be used by malicious apps. for example, the screenshot could be encrypted and you need to unlock it with pin/fingerprint whenever an app wants to access it. that way, the screenshot can be made at an instant and the infostealer still can't get it.