and what if they aren't sharing any personal data with service providers? Should they start so that you can feel their policy statement is more honest?
reconnecting
This is incorrect. Look at the code, there are many services integrations including PayPal, captchas etc. All this must be in privacy statement, as even IP is considered as PII according to GDPR.