Also if anyone obtains your xpub they will potentially be able to see all addresses generated from it.
Discussion
This was my main concern.
How would someone access this?
By being connected to someone else's node?
A compromised watch only wallet, or a watch only wallet being hosted by a third party that leaks. If you're connected to someone else's node I guess they could try to keep track of your IPinfo and log the addrsses you're pulling information on, but this is beyond the scope of my knowledge at this point.