Some web advertisements play inaudible sounds to be picked up by proprietary malware running on other nearby computers so as to determine that they are nearby.

It is unlikely free software will do this, but malware introduced by an attack could do it.

I conclude that access to a microphone needs to be controlled like access to a camera. Applications should need special authorization to use the microphone.