That would've been a cool PoC to work on as well, but seems a fair bit more complicated than the BadUSB-style attack I ended up doing. Would've had to do a lot more RE to figure out how to interact with the whole microphone subsystem, I think.

I guess you could just construct a wav file from the shell and then play it. Agreed doing it all on device sounds challenging.