This is the absolutist security perspective, where one assumes an "evil demon" threat model (i.e. every exploit will be exploited to the maximum). It's a useful theoretical model for hardening systems against known and unknown intrusion, but it doesn't realistically model the expected outcome in a world with laws and social constraints.

In practice, it's quite reasonable for a consumer to assume that the company providing them services isn't actively out to get them. In fact, we encode that assumption in law in a couple key places (to wit: if Apple is turning the camera on randomly against explicit user desire, they could be sued for invasion of privacy in the same vein as https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School...)