The way IT security has been (mis)handled by firms large and small, it’s just a matter of time till Grammarly announces a system breach and uses corporatese to hide the true impact and what was lost. When companies in highly regulated industries (like finance) get away with hardly any punishment, I’m not sure what kind of actions or threats of actions would even be effective against an unregulated company. Yes, reputation matters, but I’ve seen that cost is the main concern for many companies.

I wouldn’t trust any company with sending every keystroke (almost) to the company’s servers. That’s why on iOS I don’t use any custom keyboards, and even if I try any, I don’t give them “Full Access” (which means it can send the keystrokes over the network).