But phones have a dedicated microphone and location tracking service built in. If there is a software vulnerability (there is always a software vulnerability) then it can be remotely turned on and monitored.
There are even instances of this happening to targets of governments: journalists and activists, especially. That Israeli company specializes in it and sells access to anyone who is willing to pay.