The part that listens for the "Alexa" word is analog not digital.
It cannot be updated remotely by firmware.
Crack open the device, test the analog component and confirm the signal only fires when you speak alexa and nothing else.
Having said all that, I wouldn't buy it. NSA is known to temper with devices behind the back of companies (no matter how trustworthy you think Amazon/Google/Apple are). Check what they did with Cisco equipment sold to foreigners. They intercepted the shipment, tempered with the device and no one was any wiser until the Snowden leaks. Cisco now ships via proxy to guarantee no tempering.
American businesses shouldn't fear globalization or chinese disregard for intellectual property; their own government is fucking them.