In my view, when you deactivate "anonymous" usage statistics, you also do not want the OP to call home for any other thing.
Let alone downloading any kind of plugins, that might allow shell access to a malicious actor.
Of course my device is in an isolated VLAN, so no worries for me, but maybe check back with GDPR too.
Also I only use an older version of OP, maybe that issue is fixed in a newer one. Anyway these are just my 2 Cents!
I probably won't be back and won't read responses.