There's a bit more followup on this issue over here http://www.informationweek.com/security/vulnerabilities-and-...

In it, a Chrome representative said: "The security of our users is a top priority, and this feature was designed with security and privacy in mind. We've re-investigated and still believe there is no immediate threat, since a user must first enable speech recognition for each site that requests it. The feature is in compliance with the current W3C standard, and we continue to work on improvements."

Check the informationweek article for more, specifically around the errata to remove that sentence from the spec.