If you use someone else's node, and point your xpub at it, they can map your whole wallet, which is a major privacy issue. This could be somewhat mitigated with wallets pointed at constellations of nodes, but even if you're not sharing your xpub you're querying a list of addresses that will be presumed to be yours. And I knew there was something I didn't like about Spark that had me not using it. It does turn put the spark provider does get insight into all of the transactions users are making.