Mainly that it introduces counterparty risk and the need to trust someone to hold your sats. But since self-custodial Lightning addresses are not easy to set up, it’s hard to avoid. Everyone should learn the difference and how to move sats to wallets where they control the keys.

There are many. A few of the major ones: centralized data collection, allowing providers to profile users. Data could be shared or sold to third parties. Users depend on the provider's security measures, and weak practices can expose funds or data. They’re more likely to be subject to a regulator who might force custodians to reveal transaction data.

For a more detailed dive on lightning privacy I recommend reading to skimming: https://abytesjourney.com/lightning-privacy/