I don't believe any software is completely invisible. There's got to be a way to detect this stuff...
This is fear mongering. Sure you can update the firmware on a common phone model to be bugged, but the average user's phone is not going to be compromised.
If you know the phone's encryption key, then it's trivial to turn it on as a receiver. But that's the problem.
I seem to remember Shia LeBouf doing press events promoting Eagle Eye, and something about a government official playing for him a recording of a phone conversation he had almost 5 years ago...