You're treating can host a hotspot and can get onto someone else's network for internet access as the same thing. They're different.

(though they weren’t testing the TV itself data ex filtration)

That document does not support your claim. Being able to hijack a remote control session is not the same as using it for internet access.

Other “sounds paranoid” things companies are doing WiFi Radar is overblown. They can precisely locate you by data bursts off your cellphone without WiFi, both through tower triangulation and in person through cellular band yagi receivers if they wanted to.

The TV trying to hack other networks to send home your voice/watch traffic is both unverified and extremely unlikely. The always-on speech recognition itself is far more likely to have been accidental debug left on in a production build than a nefarious purpose simple because of the level of damage to brand recognition and the eventual lawsuits.