That sounds more like "legal asked for list of everything we collect, and anything we could collect by accident or inference" - and it leading to hilarious results - which I have seen firsthand before.
We own a Kia. I'd offer to do a GDPR data request, but my data would not give us any useful signal here lol.
I wouldn't be surprised if they could. Probably not while it's in your pocket though. They're packed with sensors that can pick up a lot. Just putting a phone on a table with a keyboard on it is enough for it to be able read your keystrokes. They can certainly tell when you're doing something that should be raising your heart rate.