They left some out: - Monitor room light level for fluctuations that correspond to advertising broadcasts for advertising proximity fingerprinting, or location

They left some out: - Monitor room light level for fluctuations that correspond to advertising broadcasts for advertising proximity fingerprinting, or location fingerprinting, ie: the illuminance profile for a video broadcast is moderately unique, and can identify the fact that it's playing on a screen near the user - Side channel for data exfiltration attacks (we require permission to use the microphone for more reasons than just listening for people talking) - Monitoring for in/out of pocket/purse state for the phone - Probably a ton of other nefarious stuff that I am not devious enough to think of.