this sort of vulnerability (stealth audio and video capture) is surprisingly common, see https://googleprojectzero.blogspot.com/2021/01/the-state-of-...