Have you considered that maybe other people
have thought about this and reached a different conclusion? I think calling it an NSA bug is pretty silly if you have a smartphone or laptop. How are those not bugs? All of these devices have microphones.
The Echo is less likely to be used as a bug than any other device because it's simple and single-purpose. When you are not using it, it is idle and will not use network throughput. That's trivially easy to monitor with my router. I can see how many gigabytes of data my TV downloads. If an Echo started consuming network throughput to upload audio when I was not using it, then that would be extremely suspicious and easy to notice. This ease of detection makes it a terrible covert surveillance device.
By comparison, I have little visibility into what my phone is streaming over its cellular connection, and devices like laptops, PCs, and Xboxes are so complicated that I cannot expect their network usage to be idle. It is unsurprising for these devices to download/upload potentially gigabytes of data while not in use, because some software has decided to patch in the background. These devices have local storage and could buffer audio and upload it during times of legitimate network activity. There is a lot of network activity in which covert surveillance could hide. This is not so with the Echo.
Additionally, your phone and laptop are far more juicy targets for the NSA or any attacker. These devices have your data! An attacker can break in and steal your documents or passwords or other data. And then they can also activate the microphone and listen to you! The Echo doesn't have any data on it, so it's not a juicy target. It's also stationary in one room and has far less ability to conduct effective surveillance on someone than the cell phone or laptop that they carry with them everywhere. Someone isn't going to take their Echo with them to the mosque or an important business meeting or whatever.
The Echo is far less complicated than smartphones and laptops (less stuff running on it), and so is less likely to have software defects that can be exploited remotely by attackers.