I have a Xiaomi device and can confirm the API request. It does this regardless of country, including in GDPR countries. It makes multiple requests like this per minute. And if you click on the Privacy Policy in the Xiaomi Smart Home app for instance, it shows a 404 error.