Well, one, they aren't watching you, they wouldn't watch you, they'd watch what your phone is pointed at or listen to what the microphone can pick up.

Just because a camera isn't displaying on the screen, doesn't mean it isn't on. It would be trivial to have it view the camera's feed. Access to the camera also includes access to the microphones. Satellites don't have microphones, planting a 'bug' requires physical access and wiretaps are only suitable for rooms that contain a phone (microphones can be turned on to listen to a place without the phone actively making a call).

It, again, would be trivial for the app developer to turn on a transmit feature at will and turn on the camera(s) and microphone(s) if the app is running. Not saying that they are, or intend to, but literally, a line or two of code would allow for it. Then it merely transmits back to the server when active and the vast majority of users never experience a data spike.

Another line of code and oh hey send at a low resolution with the app compressing it on the fly with the ability to increase the resolution if they indeed have a feed of something of interest.

The microphone(s) could transmit audio with minimal bandwidth to overhear conversations or even environmental noise. For sound, depending on quality, you are talking 6-50kbps. At 50kbps, you are talking 160 seconds of audio per megabyte of data.