Or, they don't train on it, but who's to say they're not harvesting analytics which may or may or not code samples, prompt data, etc. Which are then laundered through some sort of anonymization pipeline, to the point where they can argue that it no longer qualifies as your data, and can be freely trained upon.

Conspiratorial thinking? Sure. But if you've been around for a couple decades and seen the games these people play (and you aren't a complete sucker), then you'll at least be aware that there's at least slight possibility that these companies can get things from their customers that they (the customers) did not knowingly agree to.

This.

The belief of business users that this will remain true is grounded more in hope than in cold, dispassionate, business based decision making.

If it's not life or death, encrypt every byte of data you send to the cloud.

If it is life or death, you should probably not be letting that data traverse the open internet in any form.