Most reputable shops have a policy of firing anyone who doesn't do a factory reset before working on the phone (or, with FRP, having the customer removing the Google account). But some of them will bypass that if you sign a waiver, holding them harmless if anyone ever gets your data. (If it's all deleted in front of you, you know that it can't be "gotten". If not, some customer with good vision could have seen something from 10 feet away - no one will ever be able to prove who gave out that phone number.)