One of the reasons why I like my desktop PC so much is that both webcam and mic sit in a drawer and are only plugged in for when I actually need to use them.
Android at least has the setting in developer options to disable sensors, which includes gyroscope, camera, mic and gps, I believe.
But core system services still have permission to override this setting. Which makes sense, you don’t want your dialer app to break when calling emergency services.
But it does make me think, is Androids’ sandboxing of an app enough to prevent it from abusing this possibility?