If you would quit trolling for one moment, you could easily find your answer[1][2]. It's no more likely they will get away with sneaking something in than any other Linux Distro would as there are many eyes, including myself, looking at their source as a hobby. There are also those that dislike Cyanogen and would love to see them slip that monitor their source constantly. That is a good thing, and serves a purpose, unless it's a false alarm that "cries wolf" and gets repeated so much, everyone just ignores it when there's finally a real issue. Think about that please when you keep dragging up this current non-issue.
They also give a preview of what they are collecting when you go to the "opt out" screen on your device and the source is on Github. If you're super paranoid, compile your Cyanogen yourself minus the stats instead of relying on what they give prebuilt.
http://www.cyanogenmod.org/blog/cmstats-what-it-is-and-why-y...