Hello all,
I have noticed that when connecting Graphene OS to Windows via USB, even in charge-only mode, and even on a computer where the file transfer was never allowed to, the serial number of the phone is perfectly visible in the properties of the device appearing in Windows.
I don't know to what extent this number is dangerous if made public, but that doesn't sound right to me.