As far as I know, the "mute" button (red ring) on the Echo is implemented entirely in software. Therefore, it is theoretically possible to push a software update to the device which would allow some entity to surreptitiously listen in using the Echo's mics, muted or not. This is not something you or I could do, and Amazon has been sensitive to even turning over to the authorities the audio that the Echo now captures normally, no doubt realizing that being caught engaging in something of this nature would result in a huge negative impact on their market. Thus, I consider the "mute" button to be more of a convenience feature -- something I use when, say, a story about the Alexa app is airing on TV and causing the Echo to false a lot -- than a security one.