It's the latter. An app can't access the audio without explicit microphone monitoring permissions.