Considering the countless chips on most standard SoCs this is the correct answer. And presumably what the NSA does when they reroute your Dell or MacBook for an overnight session in a sealed off room at the post office.
Doesn’t even need to be at Amazon’s factory in China of where ever. But that is largely feasible too.
The difficulty is more about data exfiltration. Has to be appended to some real ‘normal’ request the next time a legitimate use of the mic is made, then piggybacks uploads on that connection.
Recording all times when a voice is heard would also massively increase the payload sent to the server. If you were just passively network monitoring it could stick out. Which is not something nation states want.
Forget these smart home mics, if I was a nation state I’d just stick with the mobile phones and laptops every person uses.
People are already paranoid about their Alexas inherently (and far more likely to potentially care to look) making them a poor target for hacking. It’s far more useful to turn the thing they carry around with them 24/7 into an active microphone with GPS, and plenty of more exfiltration possibilities with any mobile and desktop OS network traffic.