Mine went through a spate of randomly "talking" with no prompt.
You can check through what voice command set the thing off in the app log. In this case it wasn't possible to tell what the issue was.
However, that evening they started behaving very strangely, couldn't understand questions, commands, etc, then said they couldn't "connect". Other users were reporting "the red ring of death".
I called the support desk who said there was "a cloud" issue and their developers were working on it. Next morning everything was back to normal and my dots haven't mis-spoken since.
Except a recent radio programme on the Amazon Echo woke my kitchen device up every time they mentioned Echo,Amazon or Alexa.
The app has quite a depth of settings and you can turn "shopping" off/on and apply a security code as you wish. It's like being on Facebook, you have to check your settings. I suspect many Echo/Dot owners never actually go through the app if, indeed, it ever occurs to them, or even know it exists.
There have been reported issues with Dots being woken up by messages on phone answering machines and people have claimed to be able to open wifi front doors by calling through the letterbox, so far as I know, only reported by users testing it out rather than with any criminal intent. Although why anyone would want a BlueTooth front door lock as a security device is beyond me.
User groups have been pretty sceptical as to whether any of these reported cases of buying and criminal mis-use have actually occurred and I find them hard to believe they've happened as described. They make good stories in The Daily Fail though.