Off topic: I wonder how hard it is to poison this type of data gathering?

Not hard, one could build an application that listens on common software ports and simply returns 200 for every request it gets.

Not sure how it would benefit you telling some website you run all the software.

Is that a question?