I don't ever want to give a website access to microphone because someone could turn it on via an XSS. Websites on the whole seem to be far more vulnerable than

I don't ever want to give a website access to microphone because someone could turn it on via an XSS. Websites on the whole seem to be far more vulnerable than mobile apps because: 1. their code is refreshed on every load, 2. their software is often updated on a daily if not hourly basis, 3. they will often pull code from remote sources on every page load, 4. they don't even have to pass the minimal review and code signing of an app store, 5. and it is very likely that they are written in javascript. I agree with your general point that better permissions would improve the situation. For instance asking each time it wants to use the microphone, rather than an approve once model.