>what nefarious things can one do knowing that some anonymous user happens to e.g. refresh pages a lot (or even, how can that data be sold)?

Page refresh pattern data would go a long way in deanonymizing the user panopticlick style.