This may be true in some cases (I certainly don't have enough information to refute it categorically), but is absolutely not universally so.

For instance, on iOS, they cannot access your microphone without your express permission (though once they have obtained it once, you'd have to go into the Settings app and explicitly revoke it), and they cannot do so while the app is not open.

Similarly, in Safari on macOS, any website needs to ask permission to access the microphone/webcam, and you can revoke the permission if you want. (This isn't quite as obvious, but if you add the Website Preferences button to your toolbar, it becomes much moreso: I strongly recommend doing this for anyone using Safari.)

I know there's a fairly widespread idea that all smartphones act as always-on microphones and cameras for the shady tech overlords (or the government; whichever the person's particular fear is about), but the whole point of Apple's stance on privacy is preventing that sort of invasive, pervasive, surveillance from taking place from iPhones and other Apple devices.