IPFS doesn't fetch or store content that the user has not explicitly requested. If your application allows strangers to request arbitrary IPFS objects, this might be a concern. Otherwise, no, simply running a node doesn't expose you to this risk.

Ok, then I misremembered, thanks.

(Couldn't it be that the caching behavior of intermediate nodes still make it a possibility?)