For my smartphone to be similarly vulnerable I would need the server side plus malicious or incompetent intervention on the client end to enable voice activation (I have voice activation disabled).
Plus my smartphone hardware is not as capable of picking up voices around the house plus I am not actively positioning it in several rooms to do so.
Now, I don't think they have mics on all the time either, as it would be impractical. But rest assured they are vacuuming up every morsel of information they can for monetization reasons. And law enforcement has been banging on the door to get access. After the next tragedy they will get through.
Law enforcement wants access to Alexa devices? I don't doubt they do, but can you cite examples of them trying? What kind of tragedy are you alluding to?
(And yes, you have to trust that Amazon's devices are behaving according to spec and to what Amazon has said...)
Any ethical alternatives out there?