Your case showed that the permission system is flawed, since it allowed camera access without having asked for your permission.

Afaik the older the operating system, you’ll have more slip troughs.

Ironically Google owns both, the Play Store and Android.

Besides making the rules for app development, it has to make sure the permission system doesn’t let malicious developers make a party on your phone, running their own operating system.

It’s like the team app developing should know that team os security is doing and vice versa.

They are catching up, but It’s astonishing how well they have been failing at this task.