Leaking your XPUB is a privacy risk. Whoever gets that knows every address that belongs to your wallet: past, present and future. They don’t necessarily know those addresses belong to *you* personally, but they know the addresses go together. #heuristic attack on address spent form may be possible. #infosec 
@jimbocoin good point