It is naive to suggest that this data can't possibly be used for anything bad. This change results in Google collecting a lot more information about the software that is being created outside of Google. After this change, Go developers working on private projects will end up regularly transmitting their lists of dependencies to Google, unless the risks are properly understood and preventative steps are taken.

Google's business is collecting and monetizing information. It is entirely reasonable and appropriate to express cynicism about new initiatives that result in mass data collection.