They are just using FinFisher/Finspy to turn on the mic. Your SIM card also runs it's own proprietary closed O/S and anytime the carrier wants it can OTA update spyware via that channel too and you'd never know. Your baseband stack is yet another blackbox on the phone just waiting to be exploited by FinFisher, carriers, manufacturers, the feds or a despotic regime near you.