Not sure why anyone would find this surprising. Found a way to listen without the 'wake word' being spoken. If a "wake word" can be said to turn something on, that means it is always listening. The software on the device has to just have an event handler that is triggered whenever the microphone picks up sound, it just checks for whether the wake word was spoken and if so would then continue to parse the rest of what was spoken. So how easy is it to get your own hooks into the thing is the only question, the fact it always listens should be common sense.
For you tinfoil hat peoples, that event handler of course could just be letting users know it does somethign in cases the wake word is spoken - and could still do whatever it wanted with what it is hearing and not sending any out put to the speaker or light ring.