You should be able to block which apps have access to the network.
I know you can do it with Windows. On iOS, you can only block cellular network access with the exception of third party keyboards where by default network access is blocked. I wish I could block apps from having any network access. Can you block network access in a per process basis with Linux or the Mac?
Software won't help you. The premise is a phone where the spy agency has root and your only defense is "physical on/off switches" to control the I/O interfaces.
Then all the spy software has to do is receive a signal to begin recording, saves to a buffer, and waits for you to check twitter before uploading.