Use a machine without an embedded mic (neither of my desktop machines have one)

One that I've seen is plugging something into the audio jack, and then breaking it off and taping over it. That way the computer will detect something is plugged in and turn off the mic. Of course this won't be possible once Apple, and then everyone else, gets rid of the audio jack from computers.

Isn't that still software controlled? So, let's say a malware is able to gain privileged access to my Windows machine and can install anything, would he be able to override this default behavior of 'turning off the mic when something is plugged in', especially when the external voices are more audible than something coming from the 'plugged in' dummy audio-in cable?

It would have to be an audio device that has that little "ring" of audio in. Sorry, not knowledgeable in this field, someone smarter will be able to clarify, but I've noticed that my headphones that don't have a mic capability have less little "separator" rings on the 3.5mm jack, whereas the ones that do have mic capability have more.

Also your solution seems... excessive...

https://www.obdev.at/products/microsnitch/index.html (best you are going to get at a software level).

Ideally, get a system with a microphone killswitch, such as the Purism devices.

Whether you do that or not, use an OS that you trust to mute the microphone, and don't run untrusted applications outside a sandbox.

unplugging it

I presume GP means the built-in mic that sits next to your built-in webcam.