Leaking your XPUB is a privacy risk. Whoever gets that knows every address that belongs to your wallet: past, present and future. They don’t necessarily know those addresses belong to *you* personally, but they know the addresses go together.

The most likely way you’ll leak your XPUBs is by connecting to an Electrum server, or a vendor’s wallet that collects this data.

When you start up Sparrow, it’ll ask how you want to connect to your node. Options include Bitcoin Core, private Electrum server, and public Electrum server. For maximum privacy and speed, it’s best to run your own Electrum server. I’ve used ElectrumX and Fulcrum. I’ve heard good things about electrs but I haven’t tried it.

If your wallet has previously been connected to some other service, like, say, your hardware vendor’s app, then your XPUB has in all likelihood already been leaked. The only way to keep this private is to set up your own wallet from scratch and ensure that your wallet software (Sparrow) only connects to a private Electrum server (preferred self-hosted).