avoid any user interaction
"to avoid any user interaction to achieve an automatic, silent infection."
That's the key, and very frightening. Users assume that they will get some sort of UI notification if anything they don't want/expect to be happening, is happening.
It's scary to know how much stuff goes on in the background without users knowledge at all even with "legitimate" apps that the user has knowingly installed. A case in point is people suggesting they have seen adverts for products they have talked about. A possibility that their phone mic is being used to stream and analyse that data?
The devices people have are capable of so much, yet they are usually unable to conceive the idea that unless they are being told something is explicitly happening, it won't happen to them.