I touch an OBD2 port every single day.
I should have been more specific. They may not use this information for their product, but they are privy to it. theres also no transparency to say they ever delete that data.
OBD may be read only but CANbus pins exist in the OBD2 connector, and many CANbus implementations can be accessed through the OBD2. steering, brakes, and throttle can all be remotely controlled through the CANbus in most vehicles.
there has been at least one PoC that can detonate your airbags from the OBD. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1493...
Also the OBD protocol is standardized and the device basically operates in a read-only fashion (cannot write data to the ECU). The worst problem that actually occurs with these is increased rates of battery drain while the car is off (though most devices have shutoffs in place to prevent the battery from getting too low).