They have every reason to use this reporting requirement to collect more information about you.
They have every reason to conflate credit freeze with credit hold, and confuse consumers in order to extract regular payments from them.
They have zero reason to keep sensitive data about you secure. In fact, they have every reason to promote fear and uncertainty in the public that their sensitive personal information is in the hands of criminals as a growth opportunity for their industry to sell credit monitoring services.
They have successfully convinced the public that identity theft is a separate and distinct crime done exclusively by one person to another rather than simply fraud that they are aiding and abetting.
Consumers and credit reporting bureaus have a fundamentally adversarial relationship that no legislation can harmonize. They exist because they do serve a purpose for finance, which is to give an indication of how much money they can make lending money to someone. Regardless, this reporting does not have to be done by for-profit corporations. This can just as easily be done by non-profits or government agencies. Although these are not perfect, they are free of the perverse incentives driven by for profit corporate structures.