I can’t confirm that they can run as / view data but given that they help with debugging in many cases and don’t need explicit permission / action from me to do so strongly suggests that. Don’t see how they could debug without database access. I hope at the very least they’re limited to development mode…
