Was really concerned about that. But in the end it's really no different from a smartphone/laptop. If someone compromises my device it could also always send. I have to trust the manufacturer of my phone not to transmit audio unless I tell them to, and the same is true for Amazon.
I'm also pretty sure that people would've noticed if it always sends by default, guess some people will have monitored traffic from/to the device.
I'm using the Echo now, but I keep playing around with raspberry pi solutions. I'm waiting for Respeaker to deliver. I'd prefer to have it all in-house, but until I come up with something that works as well I'll keep the Echo plugged in.
I'm also pretty sure that people would've noticed if it always sends by default, guess some people will have monitored traffic from/to the device.