Sure and they can turn the camera on as well. I have Where’s My Droid on my phone which isn’t as powerful as something the FBI or others could develop. I can get the gps location of the phone, turn on the camera, make it ring and lock the phone. With a little tweaking I am sure the could set so that the screen doesn’t come on when the phone camera is activated, turn on just the microphone, transmit the gaps location constantly all while not interfering with the phones functions. I unserstand that they can do some of this even if the phone is off. About the only way you can prevent it is to pull the battery.
IMO, it is NO ACCIDENT that they do not put a PHYSICAL SHUTTER on these camera lenses, and a PHYSICAL SWITCH on the microphone. The videoconferencing cameras of the 80’s and 90’s came with these incredibly inexpensive bits of metal and plastic. AFAIK, no software, malware, goobermentware or whatever, can bridge an air gap or penetrate an opaque barrier.