When do you trust that your webcam and microphone are not spying on you?

Fo me, it's: when it is physically unplugged. And even then, I usually turn it away in case I made a mistake and unplugged the wrong USB cable.

It's not that I think the software protections I have set up are worthless, but I'm more confident in attackers' inability to get around physics than their inability to get around software restrictions.

Even a system that is security hardened AF, can have vulnerabilities. Xen has had vulnerabilities in the past, and a subset of them did affect Qubes.

Besides, unplugging things is **so simple** to do and so easy to verify, I just do that when they're not in use. And when they are in use, I trust #Qubes to keep the feeds limitied to the qubes to which I have granted access.