> I don't understand why this is a worry

It's a massive new change and requirement coming into force in only a few months, with basically every single report coming out of Unity internal engineering being that they don't have any systems in place to figure this out and have no idea how they will actually make it work while also still being GDPR compliant.

"Just trust us bro" and "you can file a support ticket if we get the numbers wrong" are not acceptable and are each reasons enough to worry about the potential for (or rather, guaranteed) abuse of this system.

One must assume the worst about any implementation with a system like this, in the same way that once must assume the worst about any implementation of telemetry or of DRM. You'll be right far more often than wrong.