Who are you concerned about the data going to? Intercepting a Bluetooth signal is not really a thing anymore. Your phone OS has plenty of ways to know what you're listening to without Bluetooth itself being thr vector. If you use GrapheneOS and Linux, you're good there. The headphones themselves aren't going to have a Sim card that is phoning home.

So then you're left with third party software being the attack vector. For this reason, I would not install headphone apps, and ESPECIALLY not earbuds that require connecting/registering to a third party account like Amazon Echo buds.

This unfortunately means no custom EQ. For my open ear headphones, I tried out my top 4 choices without downloading the app, and picked the best sounding & most comfortable pair. That happened to be the Nothing Ear Open. My over ear Sony XM4 headphones that I already own are amazing but needed EQ badly, so I installed the app on an old Android, tweaked the EQ, and it saved the EQ information to the headphones themselves. Not all headphones can do this, however.