They could do sneaky stuff like upload the audio after the wake word + a few seconds BEFORE the wake word. The cost benefit of this doesn't seem high especially if you consider that Amazon says all the time that they want to 'earn customer trust'.
Do you trust them not to waste this opportunity to get more user info? What about future software updates and especially user targeted software updates? They could avoid detection by only doing surveillance on selected targets. When they are caught, they can justify it with some "improving services" or "software bug" bullshit excuse.
This is an unquestioned assumption actually.
I think it's way more to do with the NLP system being very very proprietary.
I wouldn't be surprised if it could be done locally, computing is pretty powerful, but they never bothered to even try and make it work locally. Because "cloud computing" is a dream come true for businesses, hiding their special sauce, not having to explain what they're doing (whether it's hard or not) and always maintain control.
Because the wake word is able to be processed offline, there is no need for the Echo device to record and transmit audio all the time. While the hardware is physically capable of doing this (and therefore, it will never be possible to fully eliminate doubt in the device's security) it would not be in Amazon's or the customer's best interest. Talk about a waste of resources, and a privacy nightmare!