It makes literally no sense for the Hey Siri functionality to do that. This is just a very slightly altered version of "it's an internet-enabled device with a microphone, it could be hacked and told to turn on its microphone remotely", which is a legitimate, if fairly paranoid, complaint that applies to all such devices, even fully open-source and open-hardware ones.