We did some analysis on this a while back: http://interconnectit.com/1722/who-is-wordpress-talking-to/ - some seems not too sinister, but you do have to remember that there's little in the way of protection of the data sent, and that somewhere there is possibly a big goldmine of install data that isn't being shared with anybody.

Due to the relative opacity of the organisations behind WP there's no real easy answer - we can't see in very easily to anything other than the code.

Somebody will fork WP one day or another, if only to address the concerns that are required for enterprise use. That sensitive content posted to an Intranet site could find itself elsewhere (for example when using the Google API for spell checking) is a big concern.

It's perfectly valid to question these things and to look into the potential impacts for different groups of users. It may not matter if you're a blogger in NYC but it may matter a lot to an activist in Cuba or an internal communications team at a government agency.