I have clearly a bug in mediaStream.unmuteAudio(userId). When call by host, the microphone of the user with userId is immediately activated without any permission asked.
This is a serious security/privacy breach.
We have resolved this in Video SDK 1.4.0. We added an event listener called host-ask-unmute-audio which will trigger when the host asks to unmute a user. You can use this event for your business logic like triggering a flow asking the user to unmute themselves. Thank you again for bringing this up to us.