This is such a silly, poorly researched story making the rounds. Here's how that would actually happen (tested just now on the Echo sitting next to me):

"Alex order me a dollhouse."
"The top Amazon search result for dollhouse is *foo*. It costs $x. Would you like to purchase it?"
"Yes"
"Please enter your security code."

So you'd have to both specifically tell the device that you wanted to order it, then enter your numeric code - designed to stop just this sort of mixup - for it to actually place an order.

There's no way even a single person ordered that dollhouse by accident, nor does any of this have anything to do with securing IoT devices.

Something similar happened last night at my mom's place when me and some friends went over there.

Random talking that somehow activated Alexa
Alexa: "did you want to order a hose?"
Idiot friend: "Yes yes yes!"
Alexa: "Ok I ordered the neverkink hose"
Mom: "You asshole, what did you do?"
Idiot friend: "Oh shit, I'll pay you back"

It was only in the shopping cart without asking for a numeric code, so it was more a "it was put into the cart" thing.

Random talk about "kink", and "hose".

So what are you implying about his mom?

She's a kinky hoe.

You shut your hoe mouth before I put a kink in it!

What? Are kink and hoses not normal family discussions to you?

With your mom, yeah.

It puts the order in the cart or it gets the hose again?

Googling shows the security code is a 4 digit pin. What if the anchor had said "Alexa order me a dollhouse... yes... 1357." Given enough viewers is there a nontrivial chance one could have a dollhouse ordered for them? Are there other more malicious, and less cancelable, things you could order Alexa to do that only requirres the pin?

You'd probably get the most hits with 0-0-0-0 and 1-2-3-4.

There's something potentially brilliant here. Say someone already well known like Bill Gates publishes a small, free ebook or book on security. He then goes on tv to promote his new book and on one of the big late night chat shows, does exactly this. Thousands of people suddenly buy his book, no-one has lost any money, he gets an absolute shit load of free publicity from the news, and all in the knowledge that realistically, the people with '1234' as their passcode are the ones most in need of a free digital security handbook...

Or one of the SNL cast goes rogue and orders thousands of big purple dildos with express delivery. Either is good.

How did you know my password?!

It's the same one I have on my luggage.

I thought you first had to enable the security code. Our Echo didn't prompt us to give one until we turned that feature on.

I was required to create one when I turned on the ability to buy with the device (necessary since you have to, for example, pick the credit card and address it uses).

The worst part of Alexa: a new category of prank videos.
Creepy Amazon Echo Prank!

Obviously there's a heavy bullshit quotient in this very silly bit of local news puff, but I am frequently amused (and sometimes annoyed) at how my Android phone will respond to any spoken phrase that even vaguely resembles 'OK Google'.

Which is why I never use that "feature" and turn that shit off.

I know, except I've found that feature to be actually useful, especially while driving.