QueryBasicInformation is like a subset of stat(2). It can't access a file's contents. While I'd prefer Dropbox not to go looking at file metadata on my whole device, I'd chalk this one up to over-eager coding and not some kind of data-smuggling backdoor.