Google introduced a new permissions model for third-party apps in Android with the release of Android 6.0 Marshmallow. Instead of giving apps access to all permissions while installing them, Google adopted an approach similar to iOS where apps would explicitly ask for permission as and when they require it.
With Android P, the next major version of the OS, Google is going to make a slight tweak in this model to make it even better. Starting from the next version of the OS, apps running or idling in the background will not be able to access the camera. This will prevent malicious apps from silently taking photos without your information.
Despite Google’s best efforts, a number of malware and spyware apps end up making their way to the Play Store. Or worse, unsuspecting users end up installing such apps by sideloading them through third-party sites. Such malware apps are designed with only one thing in mind: to steal a user’s data. It has already been previously demonstrated that developers can silently use the camera on an Android device if their app is running or idling in the background to take pictures or even record videos which pose a huge privacy risk.
Thankfully, with this new change in Android P from Google, this will no longer be an issue. Google also introduced a minor little change in Android Oreo which makes it difficult for apps with malicious intent to run in the background. Any such app would have to display a persistent notification which would automatically end up alerting users.[Via XDA]