What times your lights are on or off can expose more than you might think over time. It reveals when you're gone for work, your sleep schedule, how many days a year you spend at home vs traveling/elsewhere, when you stay up late, etc.
But it gets worse. If you give Hue your email or install the app then now you can be uniquely id'd across other products. Hue will sell that data to some advertising agency, who also buys data from Google, Facebook, etc. Now your usage data from other systems can be combined with the Hue data and used to more even more accurately track your day and behaviors.
It can be done right: local only connections (no cloud), segmented vlan for iot devices with strict firewall rules, Internet access blocked for anything that doesn't need it, etc.
Unfortunately that takes a lot of knowledge and effort. The cloud based devices that phone home every few minutes are preconfigured and just work, so most people will just use that and not think about it.