Make it look like an accident.
Ultimately I don't think we can judge intent in situations like these, especially because it's so easy to disguise[0]. A sentence can be constructed in favor of any opinion; so I'll spare you my attempt at an alternate reading of the situation that makes them sound guilty so long as you agree that it's possible to do.
I think a few questions can be raised about whether we can trust a company's claim that a problem stops exactly at the limits of what's been made publicly visible. How do we really know that select installations weren't phoning home with their captures?
This is a great moment to plug the idea that we really should be able to see the source code of the software we're running.
They did post a bug fix though.
Why? How do you "accidentally" record someone?
The reason they store the file probably has to do with technical constraints. Maybe the audio API they are using only works with files and not memory buffers, maybe the buffer took too much space, maybe it is a workaround of some kind. We won't know without analyzing their code.
I think it totally applies here.
Not removing temporary files is a very common bug. As a developer, I've encountered it several times, sometimes I caused it, sometimes I fixed it, and I've seen it happen in other people software just as often. This is one of the reason I hate temporary files, they just don't wan't to be temporary.