> Surely the user would have had to approve microphone access for the app first, and it'd better have a good excuse.

Does it? Aren't people generally in the habit of signing off on any access if they want what an app offers?