That's not a big question, honestly. Especially financial information is very lucrative on the data market; alone the fact that someone owns any cryptocurrency or not is very valuable.
Have a look at this infographic, for instance.

I also don't believe after following different topics in the forum here, anything coming from Ledger will be really surprising. We can expect data selling, data breaching, low-quality devices and bad customer support, unfortunately.