In theory, the phone camera (and microphone) are not supposed to be on 24/7 and sending that info to a 3rd party. Whether that can be known for sure is probably known only to the hardware/software manufacturers. Supposedly, the Russian app Max randomly switches on the camera (can't find a citation for that now), so you can use that as an example of how far it could go.