It's mind-boggling that this is not enforced by hardware: as other commenters has said, both by powering the LED from the same power as the camera, and also by making the enabling of that power use a simple hardware pulse-stretcher that would prevent the attacker from enabling the camera at such a low duty cycle that its flickering would be invisible to the user.

Ideally, the same should also be true of the microphone pre-amp, with its own LED separate from the camera one.