uMatrix is defense in depth. They could solve the problem today, and tomorrow a new CircleCI programmer/marketer/CEO would decide that, in fact, they do care more about analytics than about user's secrecy, and revert this change.

By installing uMatrix and not approving these things, you are (a) reducing the probability that a mistake, misaligned incentives, etc, would harm you, and (b) get a notification that there's something you wish to block.

uMatrix IS part of the real solution. The other part is avoiding providers whose security standards are not up to yours.

Good security does generally not rely on a single measure. The service provider not doing this in the first place is good, but the user (also) having a second line of defense is objectively better, although it may incentivize poor behaviour of SPs.