But the LED indicating the state isn’t. That’s a problem. All you really need to do is make the LED a liar and the user has no idea if their mic is on or not.

I think that you (and others!) must have misread: I did not write that malicious software would turn on the hardware — I wrote that it 'could turn off the LED when the camera and microphone are running.'

What I mean is that a user could leave the hardware switches in the microphone- or camera-on positions, but malicious software could turn off the LEDs, so that the user would think he had privacy but in fact did not.