People keep bringing this up and it's silly. It can just record what you say and send it later.

It makes literally no sense for the Hey Siri functionality to do that. This is just a very slightly altered version of "it's an internet-enabled device with a microphone, it could be hacked and told to turn on its microphone remotely", which is a legitimate, if fairly paranoid, complaint that applies to all such devices, even fully open-source and open-hardware ones.

Though is that auditable? Siri's not Free Software AFAIK.

You can at least audit the network traffic. And since people have been able to hook their own software into Siri, you probably somehow can break open its encryption and look at the content. (Unless I misremember how that worked)