It doesn't seem like the kind of thing a company would try to underhandedly sneak in after explicitly saying the sensor runs on-device and "never sends sensor data to Google servers".
* Trivial in the sense of someone who actually knows what they're doing -- of which we only really need one person in order to "leak" what's actually happening.
I don't think anyone thinks that they are, or will be sending all the sensor data to the servers. But they don't need to, they only need to send back what is determined due to that data.
Specifically consider what is most likely for an ad company, a few differentiated markers to help with targeting, that can easily be packed into a few bits. And can be trivially stored to be sent later on with some other packet that has a valid reason to be sent. (Appstore update check, anyone?) Accounting for every bit that leaves the phone sounds like a nigh impossible task.
I'm not saying this is definitely happening, but I don't think it's practical to rule out the possibility, with any amount of packet sniffing.
Because I'm pretty sure there is some random "user experience checkbox" checked by default that somehow means some of the data is sent to Google so they can "improve their products and services" and what not, but don't worry because it is probably "anonymized" and will only be seen by "humans" or "AIs" depending on what feels less bad for the general public once discovered.