Website: https://www.sonos.com/en-us/shop/one.html

says "Google Assistant" and "Alexa Built-in".

Sonos products have existed for years before Google Assistant or Alexa even were a thing.

I own a couple of these. Because it has multiple options for virtual assistants, nothing is running out of the box as it wouldn't know which account to use or what service to route to. You have to go through an additional setup process after setting up the speaker for music playback.

Do you know for certain that nothing is running silently out of the box? Or cannot be remotely triggered to run?

Do you know something is running / can be triggered? Someone can't prove a negative (X isn't running) as easily as a positive (X is), so the burden of proof should fall on you. Saying "yeah, but how do you know your toaster can't be remotely triggered to record you?" isn't useful.

Maybe your threat model doesn't allow any hardware with a speaker that has updates, but that's not a reason to say it's an invalid setup for everyone's threat model nor to claim that, even without evidence, it's definitely going to be abused.

Ah ok, the burden of proof is on me. Your powerful logic has defeated me and now you are safe and sound with your smart speaker which doesn't eavesdrop on you.

You can buy a One SL, Play:5, Playbar, or Playbase.

Some of Sonos' speakers have Google Assistant and Alexa, some don't. They sell more than just the One!

You could have taken a look round the site rather than just looked at one product...