I doubt it makes a difference. The primary risk is the agent exfiltrating your private data. That's going to exist either way.
Essentially anything you give it access to should be considered inside the same security boundary. Which is quite unfortunate if you want it to respond to emails for you and also query the internet at large.
The company may not do a perfect job of security either, but I figure they'll do a better job than I can as a solo practitioner.