Unauthorized access to the laptop is a very different thing than the user (Mark Zuckerberg, in this case) browsing to a website that utilized a camera API, or accidentally clicking Allow, or being caught by some weakness in the Flash API without realizing it. He's probably also got all sorts of other protections on that laptop, but having an extra $0.01 bit of security never hurts.

I think microphones are more dangerous actually; it's hard to glean much meaningful data from most webcam streams (besides perhaps some less than flattering pictures of the user) but a microphone can pick up all sorts of confidential conversations.