It's not that simple. An application could have access to the microphone, but an OS could be providing the mute functionality, thereby not passing any data to the app even if it keeps access to it (there are hardware/software issues with releasing and reaccessing it with extremely low latency like one expects of a mute/unmute button).

The problem, as reported in the article, is that apps are not making use of the OS mute, but are instead still reading from the microphone, and some are even passing the readout to their servers.