With a separate camera and microphone, I just unplug them when not in use. For the builtin camera, I put a sticker over it.

I have zero faith in any software lockouts.

On a linux-like system, one could block access using file permissions, e.g chmod a-r /dev/snd/pcmC0D0c for a microphone. Probably less easy to do on Android, though.