I think even passively collected behavioral data (rather than, say, an active psyop-style intervention on social media) poses a threat, as it can be leveraged elsewhere.