I recall a few weeks ago how some researchers figured out that the voice-commands could be triggered with subliminal messages, too. i.e., you wouldn't have to go 'Ok Google', but rather just play a fingerprint of that sound that makes the algorithm think you said that, without it being audible or understandable to human beings. And you could hide it in other audio like music.
That feels pretty scary particularly because these devices have such a high mandate. Right now you can shop for things online by voice command. Record and send messages. What's next, sending money, sending a data dump of sensitive data like emails, passwords, contact lists?
We've already heard of some reports where you'd have a smart home device listen to a commercial on television where they were demo'ing a purchase of some product via such a device, and interpret it as a command from the owner. Amazon took steps to avoid that with their superbowl commercial, but it seems to have done so by changing the commercial, not the product itself.
Just another attack vector to worry about. I'd happily buy these home speakers if I could limit them to just downloading information, and only uploading limited pieces of information, e.g. a music playlist. I'd want to be able to shut off any of the commercial/financial or social capabilities. I just don't care about them and they're risky.