There are a number of ways to write protect the flash part where (CPU) firmware resides. Some permanent (or with a jumper), others until the next reboot, by which any attack vector vanishes.

So checking that your libre firmware locks down the flash as soon as it's done with its work can be a pretty strong guarantee.

I love hardware switches but it's a bit of an expensive tinfoil hat (especially when comms are going to be via a compromised network in any case)

Is it unreasonable to want to ensure your conversation isn't being recorded while you're not even using the device? There's hardly anywhere in my house where a software controlled microphone can't hear and that bothers me.

Not at all unreasonable, just that this solution seems expensive and ineffective most of the time the device is in use.