They seem to point at the qualcomm privacy policy to show what’s being collected. It does seem strange that they’re not analysing the packets themselves, especially since they’re claiming the data is unencrypted. The article is quite sensationalist, probably to help sell their very expensive (one might dare saying overpriced) Pixels with preinstalled Graphene.
It’s still good to keep in mind that qualcomm seems to be collecting personalised data, which they’d likely hand over to US intelligence or law enforcement if requested to, and that at least some custom roms come with the proprietary packages that facilitate this.