You're making quite a few assumptions.

1) The device is storing any amount of locally recorded audio. So far evidence says no.

2) Amazon would OTA all echos to upload everything it hears. So far evidence says this hasn't happened. It also likely won't because IMO security people monitor these devices more than anything else on the planet. Some I believe for good reasons, the others just want to play gotcha.

3) If 1 and 2 are true, Amazon keeps the data for an extended period of time.

Can we please not tinfoil hat the hell out of these devices like we do the rest of IoT sometimes?