Not sure what exactly they were referring to, but here are some of them: https://github.com/libremonde-org/paper-research-privacy-mat...
The libremonde research is over 2 years old now, and the valid bits of it were addressed at the time (https://matrix.org/blog/2019/09/27/privacy-improvements-in-s...)
Every single one of them has a configuration, despite a selfhosted instance, that phones home to centralized servers run by your for-profit company.
I'm not sure if this systemic problem is in your config files, your documentation, your defaults, your js client, or what. It's a failing of some part (or multiple parts) of the process.
Ahh. Seems like an easier problem to fix then. Doesn't Element Android remove that assumption and let you choose?