It's dismayingly easy to make an app that turns a smart speaker into a password stealing listening device and sneak it past the manufacturer's security...