There are many. A few of the major ones: centralized data collection, allowing providers to profile users. Data could be shared or sold to third parties. Users depend on the provider's security measures, and weak practices can expose funds or data. They’re more likely to be subject to a regulator who might force custodians to reveal transaction data.

For a more detailed dive on lightning privacy I recommend reading to skimming: https://abytesjourney.com/lightning-privacy/