It's all about the risk profile you're willing to accept. I personally have much more private information accessible through my phone, computer, and certain cloud accounts than I do from things I'm saying in my home, and I believe a malicious actor (potentially including a large corporation like Amazon or Google) would have a much easier time and/or would be much more likely to engage in tapping one of those sources than a voice assistant in my home.
It's certainly very possible - there was a recent story about how a malicious Alexa skill, if downloaded and installed, could siphon your entire voice history - but those sorts of risks also exist for almost any internet-connected device you own.
So, in my opinion and going by my own risk profile, those people responding "my phone's already compromised" are behaving rationally.