Amazon recently filed a patent for a system wherein while someone is shopping inside of a store, and using that store's wifi connection, the store owner is able to inspect the wifi packets to see if a competitive product is being viewed and then issue a "control" action in response.
Basically if you want to price shop while inside of a retailer, they'll be able to block the action from happening.
A German IT magazine has a proof of concept ready for data exfiltration via Apple's "find my" tracking services.
Very unpleasant. In short: a keylogger can record keystrokes but its payload needs to be harvested someday and the attacker risks to be seen when harvesting. This PoC uses random IPhones of office users for this and even works on air gapped devices and needs no physical contact - in fact, the attacker does not even need to enter the building a second time. Apple has been contacted and asked for counter measures,