Jumping from one exploit target to another in a chain is pretty much how all modern exploits work. To say that because they would need to find an exploit in the USB driver (or some other hardware or software interface), not only states the obvious, but more importantly misses the point: it's far more plausible than most engineers intuitively believe.
The depth of modern exploit chains is incredible, and while the conceptual difficulty has gone up the pace hasn't seemed to abate, which is clear evidence that our intuition about "too difficult" and about the elasticity of the exploit supply and demand curves is woefully inadequate to accurately gauge risk.
Part of the problem is that the complexity of the systems grows at the same time as improvements in security and correctness. Sometimes it grows faster, sometimes slower, but it's dynamic.
I mean, even if you could turn on the mic/camera, I would think you still need to possibly save it to storage for retrieval later which pretty much requires the OS to be running.
Otherwise, maybe, you could somehow transmit the data but that would require the ability to communicate with the device via Bluetooth/WiFi and for the data from the camera to be passed to the wireless interface.
Unless a device was designed with that sort of functionality, I'm not sure how the NSA could just turn that on.