In theory, the hardware should be designed so that it's impossible to use the camera without turning on the light, so it would require the device manufacturer to be malicious in advance, which is even less likely. Of course, there could be bugs, but it shouldn't be hard to design such a feature correctly. (Note that since there are cases of people being spied on by their laptop webcams, as mentioned elsewhere on the thread, but always with the light on, it would be quite a serious issue if someone discovered a way to disable the light.)