It is problematic but has no perfect solution. Create data security and governance requirements contractually. Require the vendor carry insurance and prove their controls and processes. If they fail to protect the data provided, require penalties outlined in the data processing agreement (if any).

Alternatively, 23andme could offer compute to pharma companies that can run against their genetic data lake, with DLP and data security controls between them and the pharma customer. This would minimize leakage potential while still allowing compute against the data.