I think it’s important to distinguish expected privacy vs actual. The fact that I allow it to send my queries to Amazon isn’t a privacy issue.

If the network behavior showed it was sending data it’s not supposed to do, that would be noteworthy.

So this paper is helpful in this regard (in addition to other material).

This was a computing paper trying to prod for security holes, not a political statement. It's not relevant the device itself might be problematic, only that it's security is sound.

The security concerns about such devices are primarily regarding its communication with Amazon and Amazon's potential use of the device for surveillance and behavior tracking. That wasn't investigated in the paper.

I think most people know that an Echo is going to be sending data back to Amazon, and for people who know this and are fine with it, there's nothing wrong with having an article about the device that doesn't beat that dead horse. I know my phone has a GPS. I know Google gets an astonishing amount of my location data from it. I don't need every review to tell me so, and would get annoyed pretty fast if every single review of every single phone went out of their way to remind me of something I already know about them.

Of course, the question is never "is Amazon getting data about me" but "what data is Amazon getting about me, and how can they use that to invade my privacy", so I don't see how yours is really addressing the concerns per se.

That is among the interesting questions, not the sole interesting question.

This paper seems to answer “can entities other than Amazon get data from me via network exploits?” and “are drop-in calls transmitted in the clear or using end-to-end encryption?”

You might not be interested in those answers if you’ve already concluded you’ll never own one, but that doesn’t make them uninteresting to everyone else.