Especially since it's operated from a Five Eyes country.
The problem is its always been there. Telemetry provides more noise to hide exfiltration of sensitive data, but the risk has always been there from the start for the reasons you laid out.
It's a closed source product in a surveilence heavy country. Telemetry or not, it's risky.
If they were going to "de-identify" the data for their telemetry, then I'd need to see some rigorous mathematical proof of it, to have any trust in their promises. You will eventually compromise the individual datapoints in a dataset, given enough queries. There is in fact a field of research that specifically studies just this. The PMs at 1password haven't done their homework, they're just waving their hands, and it is worrying for users.
The problem is its always been there. Telemetry provides more noise to hide exfiltration of sensitive data, but the risk has always been there from the start for the reasons you laid out.
It's a closed source product in a surveilence heavy country. Telemetry or not, it's risky.