Tbh, it doesn't seem much different than having to watch out for not stuffing PII in logs.

Besides, with wide events, it seems possible to apply data lineage ideas and mark certain fields as sensitive and restrict access to them.

As of a few years ago when I left, this was completely solved by the data catalog. The columns are typed and require identification.

To me this seems easier than the alternative model (logs, metrics, traces), in that you only have one abstraction to contemplate handling PII in?

In what way is this worse than the alternative?