They aren’t collecting anything. This isn’t a telemetry feature. It’s more like antivirus. Before it lets an app run, it queries an online blocklist. Apple uses

They aren’t collecting anything. This isn’t a telemetry feature. It’s more like antivirus. Before it lets an app run, it queries an online blocklist. Apple uses this to immediately shut down attacks on their customers. People who have been hit by ransomware and lose their entire digital life really do appreciate features like this. Apple has a different, unrelated telemetry feature that is clearly labeled.