There have been apps actually doing this on both Android and iOS (e.g. the Spanish football app).
But everyone have been quick to plug this hole. Android now warns you if this happens, and Google has thrown out apps that did this (unfortunately mostly legitimate recording apps).
You are free to test this yourself: talk a whole week about your new dog and how you are desperate to find good dog food and see what happens.
(Mentioning dog food since this is how one YouTuber tested this with Cortana on PC)
Thinking about it, my need to constantly remind my Android phone to f Google (I actually don't hate Google, I do it just in case they are overhearing me...) is already a sign that I am being paranoid.
Just an anecdote, and probably more on topic: Some western reporter changed her WeChat (Chinese chat app & more) password to fkCCP. 10 minutes later her account was deleted.
There have been apps actually doing this on both Android and iOS (e.g. the Spanish football app).
But everyone have been quick to plug this hole. Android now warns you if this happens, and Google has thrown out apps that did this (unfortunately mostly legitimate recording apps).
You are free to test this yourself: talk a whole week about your new dog and how you are desperate to find good dog food and see what happens.
(Mentioning dog food since this is how one YouTuber tested this with Cortana on PC)