I also experienced this, albeit deliberately. I saw that it was possible, and out of morbid curiosity, enqueued a song to play through it. I immediately questioned why anyone would want it, stopped play, and disabled it. There are settings on the thermostat you can change such that it isn't used for playback or recording.
Sorry, I was unclear / misunderstood your statement. I haven’t tested this with Spotify, but disabling the thermostat’s mic (Settings / Device Microphone) disables Alexa and Siri implicitly, and also seems to remove it as an AirPlay target, which is primarily how we stream music to Sonos.
Apparently a firewall rule is about the only way to stop this.