Are smartphone apps theoretically capable of detecting what a user is looking at?

Eye Tracking for Everyone. 2176-2184. 10.1109/CVPR.2016.239. (2016) - Krafka, Khosla, Kellnhofer et al

Our model achieves a prediction error of 1.71cm and 2.53cm without calibration on mobile phones and tablets respectively. With calibration, this is reduced to 1.34cm and 2.12cm.

So yes - it is possible. This particular study was performed using iOS and achieved a read rate at 10–15fps.

There are several companies selling products with similar technology - UMoove for example. It would not surprise me if a higher precision than in the mentioned paper could be achieved.

If you are paticularly concerned a number of smartphone camera covers are available - here is one example.

Some 20 years ago Canon implemented in their yet analogue SLR cameras the autofocus system, that focuses on the object the photographer was looking at. The user had feedback what direction was chosen.

So yes, it is possible to determine it, even if the accuracy may be questionable. There can be adviced to deny camera permission to all applications​ but those that really need it.

As Hector answered it is certainly possible, however iOS and latest Android allow you to disable permissions for an app. This (in the absence of system vulnerabilities) would prevent any such app using the camera.

As a general rule giving an app's requested permissions a once over is good practice. If your free card game needs access to your camera then it's probably not the right one to install.