Most if not all airdrops require your email, mobile number, and personal information to submitted(though you can fake your personal info), and some even going as far as requiring KYC, which is significantly more dangerous.
Some even require you to sign up to their website with an email and password. As evidenced by the general caliber of bounty hunting spammers on this forum, most people chasing airdrops and bounty campaigns have very low technical knowledge and very poor security practices. I have no doubt that many people whose web wallets or exchange accounts are being hacked are because they signed up to some sketchy altcoin website with the same email/password that they use on several sites.
Also, as you say, having your identity stolen can have life-long ramifications and costs you tens of thousands of USD/EUR/GBP/whatever to sort out. Risking that for a handful of worthless tokens is crazy.