`AppleCamera` used by Google Chrome even with all extensions+apps disabled/tabs closed
You have presumed too much from the software's name. The CoreMediaIO Device Abstraction Layer (DAL) Apple.Camera.plugin does not control the camera, and wouldn't know how to control it even if you gave it permission. It has one job: to manage video (and muxed) streams from video devices that are already streaming. With no hardware driver running in the kernel, there can be no power sent to the camera--no kext, no power, no picture: Apple Documentation

So, why is it running? It helps avoid a little wait time when it is called into actual use. It's been there for well over ten years, and if AppleCamera.plugin was a vector for intrusion, we'd have heard much sooner.