It has not been disproven. A simple Google search "is my phone listening to me" provides a resounding yes.
These things need to hear your prompt at the very least, which entails (in many cases, if not most) listening at all times.
Security researchers DO look at this and they, along with everyone else, just shrug because you technically DID give consent when you accepted the thousand line policy you didn't read.
Hot word detection to activate an assistant occurs locally on your device for the purpose of activating said assistant. That is a far cry from “Pretty sure Apple and Google already do this, just to all phones, in all homes, and not just for music, but your entire life!” which suggests that both Apple and Google are deploying a dragnet uploading a 24/7 recording to their servers for nefarious purposes. That is just simply not true. That at minimum would leave a constant trail of bytes being sent over the network (which isn’t the case), and would massively drain battery life. It’s also highly illegal.