The indicators are controlled along with sensor access at a very low level within a secure “exclave” from the main kernel; this is how the on-screen indicators have worked on iPhones for a few years. The indicator is rendered within the display controller at the firmware level, so can’t be affected by anything in _either_ user mode or kernel mode. [1][2]

1: https://randomaugustine.medium.com/on-apple-exclaves-d683a2c...

2: https://asahilinux.org/2021/08/progress-report-august-2021/#...