A paper came out recently that uses keystroke timings+deep learning to fingerprint users (and authenticate them in this case): https://www.usenix.org/system/files/usenixsecurity23-piet.pd...

In this specific paper's use case, it's not a security threat, but you can definitely cast it as information leakage.