>there's no way they'd be able to keep it secret, NDA or not, and there'd be a massive shitstorm about it.
If a developer goes public with that information, their career is pretty much over. They get sued for millions of dollars and their life is pretty much over.
The developers working on it could be led to believe they were working on something else completely. It only takes 1 person to pull the libraries together, and that would have to be someone you trusted.
Coca-Cola protects their formula by having several vats of stuff, so to make Coke, you mix 1 part vat A, 2 parts vat B, and 1 part vat C and you're done (just a hypothetical). Some people knew what was in vat A, but not vat B, etc. The same thing can be applied to programmers.
>there's a big difference between how people intentionally speak to a phone (e.g. making calls, FaceTime) and just ambient audio from a phone in a pocket or on a table.
Siri can do it easily. You have to be in close proximity for it to respond. Say "Hey Siri" from across the room and nothing happens. Just check volume levels and that's it. Anything quieter than a few decibels and you ignore.