Link didn’t work. Chrome is set by default to ask the user before activating the webcam. Are you saying that websites can bypass this?
A normal television. He has his laptop on his table to his side. Meaning that he was not using the laptop at the time. When he checked his laptop, that was when he noticed the popup had been sitting there for who knows how long.
It isn’t a secret. 
https://null-byte.wonderhowto.com/how-to/hack-like-pro-secretly-hack-into-switch-on-watch-anyones-webcam-remotely-0142514/
Notice I said directly through the browser. This attack involves installing a service onto the user PC. Not even remotely related.
Which can happen simply by going to the wrong website. It is possible. Which is why the service to
protect your webcam is offered and not only by Avast.
Yes, I understand it is possible, but I am not aware of any current exploits that are capable of delivering the malicious payload with the current versions of Chrome or Edge. This type of exploit was rather trivial through browsers like Internet Explorer as it lacked sandboxed processes. I believe it is safe to say that this is not what happened here. An attacker would not want to be displaying the webcam to the victim, they would be silently capturing footage without them knowing. What he described to me was a popup showing the output of the webcam to him, with a message about avast’s webcam shield alongside it. That is the only information I have to go off of.