Ideally, get a system with a microphone killswitch, such as the Purism devices.

Whether you do that or not, use an OS that you trust to mute the microphone, and don't run untrusted applications outside a sandbox.