His demonstration video is suspect: he hides a popup of the same domain authorized to access the mic behind the main chrome window, which is convenient because in real life popup windows usually appear in the foreground and are quite noticeable, if they weren't blocked by chrome’s popup blocker all together.
He is misrepresenting his personal disagreements about UI/UX decisions as exploits or bugs in chrome which is disingenuous, especially as he edits his video to hide the safeguards (mainly the popup blocker).
Also the speech API does not send audio to authorized site only machine transcription of the audio which is not as pertinent, which also speaks to the misrepresentation of the author.