1. Telemetry as implemented is usually sloppy. Even though intuitively one could think that telemetry means “data gets collected locally and fired off to a remote server”, we have seen time and time again that they also build a return path to make the telemetry gathering more powerful. That return path can be a vector.
2. Web browsers have a _huge_ surface and they connect to remote servers constantly. The industry does very well at being proactive and at addressing CVEs but the whole premise makes that very difficult and so we cannot absolutely claim that browsers don’t have RCE(s).
I'd go out on a limb here perhaps, but I'd claim that if your telemetry means that the one SENDING the data gets a RCE by default by it, you're doing telemetry very wrong. Maybe look into different libraries/services than the ones you use today, please.