The answer
It can. Exported xpubs or descriptors can reveal linked addresses and transaction history to whoever receives them.
What to do next
Check whether queries go to a third-party server or your own node.
Sparrow Bitcoin desktop wallet
This resource helps with the question, but is not presented as a commissionable partner.
Visit Sparrow Bitcoin desktop wallet ↗Useful research or product resource; no affiliate status assumed.RELATED PRODUCT OR SERVICE
Trezor hardware wallet
Related self-custody hardware; verify supported coins, networks and recovery standards. It cannot reverse an already compromised seed or fraudulent transfer.
Explore Trezor hardware wallet ↗Official website; affiliate programme available to apply for. No tracked link or partner approval yet.