All apps, even Safari require your permission to access the Camera. In Safari’s case, the website itself has to initiate a request for camera access. It can not be hidden by some tricky web popup. It has to go through the iOS notification’s, so the request will be quite clear.
Check your Privacy setting to see what apps have what permissions.
To the best of my knowledge apples’ own remote desktop software does not work between MacOS and iOS. However, there are many third party remote desktop apps. They have to be installed on both the computer and iPad. You have to set up the permissions and access. Security varies, but the better known ones are state of the art secure. Do your research. I’m currently using Splashtop to remotely access my Windows laptop on the rare occations I need remote access.
At this time there are no known viruses or other exploits in the wild that will allow remote hacking of up-to-date iOS devices. That could change at any time. This is true of all computers and devices that have internet access. Apple is better than most at security, so I’m not overly worried.
Now, it is possible for you to open the door, but buying questionale apps and giving them access to your contacts. Apple does a pretty good job of policeing the App Store, but it’s not perfect. Do a little research. Consider the developer and their app description. If they are offereing to-good-to-be true services for free, look harder before installing.
It is also possible to find sources that will install apps for you outside the App Store. Almost all of these are a scam of some type. Stealing your data is probasbly the least offensive thing they’re up too. Extreme caution is advised. There was a jailbreak community, and one or two fairly trustworthy app stores. They are all but dead.
There is no absolute security. Apple offeres pretty good security, better than most.