A security risk is by nature hypothetical. If the risk comes to fruition, it's no longer a risk, it's an event or an incident or whatever.

I think it's right to say such data harvesting posses a security risk. I don't necessarily think the nationality of the corporation collecting it makes a huge difference though. If the concern is state level abuse of the harvested data, sure, it's much easier for any given state to access data when the data is stored by an entity that has strong state influence, but given the patterns of hiring at large scale data collectors, it can't be too hard to get state operatives into positions where they have large scale discrectionary access to data.

Also, I'm not really convinced that the FCC is expected to consider national security concerns, or if they have significant regulatory oversight of the app store market either?