I mean presumably they have some decent heuristic for what are "user-identifiable" parameters.

But I don't trust that heuristics works for every query parameter for every website on the internet.

Here's one: Imagine you run a small website and send signup confirmation emails. Suddenly, 20-30% of your users can no longer complete signups and you have no idea why. Oh yeah, our URL is:

mysite.foo/signup?uid=139191238123.

And apple filtered out the uid parameter.