Model updates aren't as anonymous as they look
It's tempting to assume that once raw data stops being transmitted, the privacy problem is solved. It isn't. Model updates are computed directly from local data, which means they can still encode information about that data, sometimes more than expected. A model update is essentially a compressed reflection of whatever it was just trained on.
Researchers have demonstrated several classes of inference attacks against federated learning. Membership inference attacks try to determine whether a specific data point was part of someone's training set at all. Model inversion attacks attempt to reconstruct approximations of the original training data by analyzing how the model responds to different inputs. Neither requires access to the raw data directly, only to the model or its updates.