Data exfiltration is not necessary for this to be a privacy concern; data becomes a liability as soon as it's collected even locally.

EDIT: in this case, however, data exfiltration is happening, by means of Apple's closed-source software blindly sending HTTP requests to unknown servers. Apple might not be the recipient of the exfiltrated data, but the exfiltration is happening nonetheless.