If you don't use their sync service, all your vault files are local only, and there isn't any mysterious telemetry happening in the background.
If you do use their sync service, it's end to end encrypted with your own local-only password, so Obsidian doesn't have a backdoor to your encrypted remote files either.
If you don't trust Obsidian's sync service, but want to sync files, you can sync your files in any other way you choose, like with git or webdav. You can keep it all self-hosted if you want to.
You could encryt your entire local vault too if you want to.
Obsidian's business model is just selling the sync subscription service. There's no ads component to incentivize data collection/tracking and pissing off their entire customer base.
So I can't find it in me to be worried about this one.
And if Obsidian did go rogue one day, the files are basically exported already, so whatever, it'd be easy to switch to something else.
I think the open-source obsidian plugins that aren't yet popular enough to have a lot of eyes actually checking over the source code yet are more suspect than Obsidian itself. Open-source on its own doesn't always actually prevent malicious actions or privacy violation, since most people just treat "open-source" as "this app is automatically trustworthy because surely someone else is keeping on eye on it" and either don't know how or don't bother to look at the source code themselves. But I'm not actually worried about that, either.