My takeaway was just that the root access gave them the ability to find out what was being recorded, and they were able to play back recordings that it made.

It didn't appear to me that they were initiating anything.

You can see them running "nohup arecord" in the video.