All "hardware access" from an app is actually access to an abstraction provided by device drivers and/or HAL. In principle, this seems a safe assertion to make - especially with the first use case below. Beyond that, it's paranoia. :)
User's existing data is not at risk if the hardware access doesn't indirectly provide access to the data. e.g., microphone / speaker access may be considered okay.
What if the hardware can indirectly access the data - e.g., if it can access the networking hardware (wifi for example), can we assume that it is actually accessing a driver which is a high-level abstraction of the device? If so, does the abstraction isolate the app? What if the access is to the baseband radio? Can it make a network request (e.g., international call) and infer user info (e.g., "does the user's plan permit international calls"; or combine two accesses - make a VOLTE request - and obtain prepaid balance info from the LTE stack?)
The other extreme of the paranoia is about - with access to the camera and microphone, can the app deduce user info by making additional requests to biometric identification databases (lame example: can facebook identify the user even if logged in with a different persona?)