Apollo can have analytics disabled. Any 3rd party client defeats ad engagement tracking. You can curl their API yourself and you have defeated tracking. If the client isn't serving ads, like Apollo and Tweetbot, there isn't any engagement to track. It's limited to what you interact with while logged in. This is how every service works. The analytics for 3rd party clients are purely for the developer to improve their app, they don't care about what you do on it, that information isn't relevant to building a 3rd party client.

Security/Privacy all depends on your threat model and what compromises you are willing to make.