Exif can be useful instead of only be tagged as "privacy intrusive".

My rules of thumb
If you process pixels, normalize orientation first.
If you publish or store user images and want to preserve privacy, strip metadata intentionally.
If you parse metadata, treat it as untrusted input.
If you only need one tag, you can maybe parse one tag. If you need all the things, use a tool that has spent decades learning all the things.