To emphasize: the article about Qualcomm sending back data is fearmongering to sell their own products. It's unnecessarily alarmist, and phrases things very misleadingly.
Like how "list of software" refers to Qualcomm's baseband processor software, *not* the software you've installed under Android, but they've conveniently phrased it to imply that it's the latter.
I haven't yet settled on whether the information that Qualcomm sends back is actually technically necessary, but Nitrokey's assessment is *definitely* wrong, and seemingly deliberately so. It's marketing, not a legitimate security disclosure.