Usage reporting. Crash reporting is on by default without asking, as is use of the public relays.

The arbitrary remote code execution vulnerability is much more troubling and critical, however. Most people don't realize that by running syncthing they grant the syncthing developer the ability to execute any code they want on their machine (including the ability to read or exfiltrate any file on the filesystem).