The PineTime (Pro) is the one place where this shouldn't worry you because whatever software you're running on it was installed by you so you've hopefully vetted it for security.

good luck to vet its unique bluetooth stack for vulnerabilities and unknown debug modes