You're correct about microphone permissions related to the SDK. On iOS, this means displaying the top colored bar when you're using the microphone too... IMHO it's not something you can just turn on and not realize it's being used.
We use our listening tech at concerts and event to distribute triggered content and messages from the speaker infrastructure to attendees' phones (ex. "this drink line is long, go to the other one", "here's a free song from the artist on stage right now", "<sponsor> is giving away a free thing", etc.)
The Brooklyn Museum did a nice writeup of why bluetooth beacons at scale didn't work for them.
https://www.brooklynmuseum.org/community/blogosphere/2015/02...
Sonic networking in action: [1] http://smus.com/ultrasonic-networking/ [2] https://gigaom.com/2014/06/26/chromecast-will-use-ultrasonic...
It could be a "Smart" TV though, listening for your phone/tablet/laptop, or a device installed in places like cafes...
In terms of entropy, breathing rate is a lot of information: several breaths per minute. So if something of that rate can be noncooperatively recovered, the claim in your comment about cooperative recovery is dubitable.
b) lots of developers use ads or other SDKs in their apps, not to mention we just saw Xcode poisoned with a malicious SDK
No one other than one person has ever talked about it.