I own a couple of these. Because it has multiple options for virtual assistants, nothing is running out of the box as it wouldn't know which account to use or what service to route to. You have to go through an additional setup process after setting up the speaker for music playback.
Do you know something is running / can be triggered? Someone can't prove a negative (X isn't running) as easily as a positive (X is), so the burden of proof should fall on you. Saying "yeah, but how do you know your toaster can't be remotely triggered to record you?" isn't useful.
Maybe your threat model doesn't allow any hardware with a speaker that has updates, but that's not a reason to say it's an invalid setup for everyone's threat model nor to claim that, even without evidence, it's definitely going to be abused.
Ah ok, the burden of proof is on me. Your powerful logic has defeated me and now you are safe and sound with your smart speaker which doesn't eavesdrop on you.
