This is literally how it works. In modern android you need to explicitly grants microphone permission to apps the first time you use them. Now, if they are clickjacking the permission notification, that’s something different, but the article doesn’t mention this. You can download your own microphone logs and verify if you are curious about this.