The UPI protocol lets the acquirer lookup this to get additional information, and this is being used by several acquirers, notably Smartbuy@HDFC to provide phone numbers to merchants.
Banks / UPI vendors have to comply with very strict data regulations and the confirmation of a "data leak" is enough to attract heavy penalties from the NPCI and RBI. Most banks and UPI service providers will never risk it, specially post the DEPA guidelines which have recently been adopted.
Using Cheq, you can keep your bank account plus mobile number secret. Everyday small value transactions can also be consolidated separately from your main bank account.
I don't think anyone is selling data in the UPI ecosystem but if they are, that's a very short-sighted strategy to make money for sure.