Guilherme Rambo has written a technical deep-dive and a proof-of-concept app proving what Apple has said is impossible:
TL;DR: Any app with access to Bluetooth could record your conversations with Siri and audio from the iOS keyboard dictation feature when using AirPods or Beats headsets. This would happen without the app requesting microphone access permission and without the app leaving any trace that it was listening to the microphone.
Seems like a massive security bug in the Apple product ecosystem. Let’s hope it gets fixed soon.