I don't know, my first response to the whole IOT thing is "no." I usually think of it as my juicer spying on me. On the other hand I lost the remote for a few minutes to my TV and I felt greatly inconvenienced at the prospect of having to change the volume by getting up and crossing 10 feet of floor to press a button.
I'm curious where does the voice decoding occur? is it in house or is it in the cloud on some google server? I think the thing that gives me the most pause is not so much that someone will hack my house and set the microwave to kill as much as the idea that there is a microphone listening to me all day.
Mics on the devices listen but do nothing till they hear the correct phrase. For google home it is "OK Google" or "Hey Google". Then it will take that phrase through its voice recognition, which is at google. This is the same for all voice recognition devices. Even voice remotes do this off premise.
By default it listens for command or question for a very short time then reacts. You can set it so it listens after reacting for a continued conversation... another question or command.
You can have them react to every voice in your family differently. When I talk to it, any list, timers, meetings, or calls are stored on my Note 8 phone. When my wife talks it stores her items on her phone.
At any time you can go online to your private settings on google and see anything you have conversed with google home. From there you can clear it all or keep it. The purpose of this is so you can see exactly what it picks up day to day.