The basic assumption at play here is that data about you that you don't control is likely going to end up being used against you, which I think isn't unreasonable. Flawed risk metrics, even if they are only used to benefit those who are flagged, may still turn out to be unfavorable for some employees (eg for the false negatives).