Not all malware is the same. If there was a malware bit of code that did nothing that brought attention to itself as it silently sat there retransmitting every piece of data you entered, every interaction with every website, every document created, etc, the owner of that malware would have access to so much information that they could so so many things with that data that may or may not directly affect the user of that device. That would not make that malware any less vile just because it didn't encrypt user data or something obviously hostile to the user like that attracting attention to itself. That type of malware is almost there with social media SDKs used in websites, apps, etc.

There are ways that I can't even imagine that other people can imagine how to use that data for nefarious means.