Indeed, but should we always assume data of any type we generate for services can be used for malicious means?

To an extent, but realistically it wasn't really reasonable to expect a cutesy Pokemon game to be used for this ten years later. If you had told the average Pokemon Go player this ten years ago you would have been called crazy. The Pokemon Company should have done more to protect their brand (I would hope for regulation too on player-generated real world data like this)