The user preferences data in a data request export is not necessarily for the correct user, as the export_user_preferences() method makes no use of the passed userid.
To reproduce, on a server with the boost theme, where the administrator has marked at least one user tour as completed:
- Create a new user
- As admin, in tool_dataprivacy, create a data request for that user and follow the steps required to get the zip download
- Open the zip file and go to System\User preferences\tool_usertours.json
- You see data, which you shouldn't, and this is for the admin user