1. many modern smartphones can be configured (and are configured, by default) to listen for keywords like "ok google" to start a search. So if this is enabled, then technically, yes, your phone is always listening
2. I think that there's a lot of serendipity involved in the stories. Sure, there's malware, and I 100% don't trust that facebook isn't constantly listening if mic is enabled, because I don't trust meta at all, but I think that a lot of the time, people notice the subsequent ad or whatever because the topic is still on their mind, and don't notice all the stuff they see that's _not_ relevant to what they were talking about.