So the problem is that you are concerned that this device might spy on you via the camera/mic, rather than that they can monitor your activity while using the device? The obvious solution is that you turn it off when not using it - if they have a problem with that then you don't want to be working for these people. I'm assuming that this is an employer-supplied device used only for work purposes (I'd not have anything of my own on a device which an employer was able to monitor).
The short answer is "yes", any recordings could be stored in the "private" data of an app, which unless you have root access you won't be able to see other than via that app itself (and I assume they don't let you go into whatever app it is and fiddle with it). There's nothing special here, that statement is true of any app at all, e.g. your web browser stores data this way, your Settings app stores data this way, etc. Your camera app stores images in the "public" storage because you want other apps to be able to see them (e.g. gallery apps), but most apps store most of their data where only that app can access it.
Data transfer being hidden would require a deliberate effort (whereas placing recordings where you can see them would require choosing to do that), and would require altering the system. But I'm not going to be rash enough to exclude the possibility: I've never used an Android app where someone else was administering it, so have never had the chance to poke about and see what they do.
Of course I would assume that there are legal limits on their ability to use such facilities, if you can show that they were doing it.
