kernel-power have sysfs entry allowing to *completely* disable red "privacy" led, no matter of circumstances (so, it won't work, even when application try to light up this led explicitly, like Lanterne for it night-vision friendly torch):

Remember, you need Pali's kernel-power (in reasonably recent version, like not something 2 years old) for it to work, and it reset itself on reboot. Personally, I've this one-liner as script inside /etc/event.d/, so it sets itself automatically on every boot.

As for flash led, there is an option to disable it in camera-ui preferences - those two things combined worked for me in otherwise risky situations, but, in life-threatening ones, mechanical methods - like sticking it with tape - might be the most reliable thing.

/Estel