If you have an enemy that's committed and skilled enough to break into your house undetected while you're not there just to listen in on you, I feel like they could just plant a bug or something.

in theory a software rooted echo would be superior to a bug; fairly high quality positioning by the victim which ensures good quality recordings and a fair amount of plausible deniability opportunities by the attacker. if discovery was considered inevitable software can be tripped into wiping data or reverting states.

They could also put a bug in the echo dot. Free power supply!

These are not mutually exclusive ideas and replacing an existing device is much harder to detect.

If you're allowed to break in and replace it, do you even need to root it? Just hide your own separate listening device in their house.

You don’t need to root the device for that attack vector. Just put whatever device you want inside an Echo Dot case and pass the audio through to Alexa so that it behaves as expected.

You'd need the rooted unit to be logged into the user's Amazon account and have their wifi password, otherwise they'd notice something is wrong quite quickly. Yes, most would probably just redo the setup and forget about it, but that's still quite a risk and requires a lot of access.

Hi! Author here. Yes, whilst it is possible, you would have to boot the device using a computer every time, which renders it a pretty useless spy bug. It also wouldn't function as expected, whilst it would appear to be muted, pressing the button again would not work and it would only function normally after a reboot with a computer. Having said this, I guess it would be possible to have the script wipe itself and reflash the modified partitions when mute is pressed so it works as normal again after a reboot.