Not sure how extensive the Ledger leak was, but if it included public keys/addresses as well as names and mailing addresses addresses, they could target people with large cryptocurrency holdings.
The European data retention law certainly wouldn't apply if their backends aren't actually receiving this data..
However that might well be that of a third party, or their own but without any unique/linkable identifier being transmitted with the requests.
Certainly these endpoint have no authentication / user accounts though, and I don't think it'd be easy for some low level hacker to associate an IP address with a specific person.
The current ones don't seem to require creating an account/linking to the profile used for ordering the device, so a targeted attack as described in my parent post does not seem possible, but I don't know if it's always been like that.