The xpub keys don't get sent to Mycelium server. The account gets set up just like a normal Mycelium account, where all the information on it is only on your phone. It just asks you to plug in your Trezor when the wallet app needs to sign a transaction. Mycelium servers do see you broadcasting a transaction (use Tor), and can tell which addresses are yours when you update balances (again, use Tor), but so can any node you connect to with any SPV wallet. At least Mycelium doesn't log any transactions or balance requests, and as far as anyone else on the network knows, your transactions originated from Mycelium servers, not from your phone.