I was going to post about how there was a whole thing a few years back about how people suspected there was some malware using audio frequencies out of the hearing range to try to circumvent airgapped systems.[1]

Then I did a Google search and found that it's much more common now, which academic papers, actually developed malware and security software, and Blackhat talks on it.

So, yes, audio is used in data exfiltration, or at a minimum it's a known threat vector.

1: https://en.wikipedia.org/wiki/BadBIOS