Researchers at cybersecurity firm Checkmarx say they found a flaw that could have let the smart speaker record users without them knowing it.