That's true, but sending the voice commands to Google/Apple for processing isn't fundamental to the functioning of the phone. I can and do use a phone without ever using any voice commands, and at least on standard distributions, I've never heard of anyone packet sniffing and finding that voice is recorded and sent out when someone isn't using voice commands. Unlike Alexa, being a bug isn't inherent to a phone's fundamental function.

Certainly phone security is a problem, but let's not pretend it's as fundamental a problem as Alexa's complete lack of even pretense of security.