Google Begins "Gmail 2.0" Rollout
Allowing access to external mail accounts via IMAP doesn't actually prevent them from doing this (getting my data). They still have to process the mail data in order to display it within the Gmail interface -- there's nothing stopping them from storing the data on their servers and using it for whatever they use it for (i.e., ad targeting). As long as they're treating my IMAP server as the "live" copy, my experience is the same.
In fact, they could even be open about this and call it "caching", and use their store in the event they have a problem connecting to my IMAP server, or if I'm accessing the same email message a second time. I wouldn't have a problem with this.
But, this doesn't address the needs of corporations, where the primary concern is simply having the mail on Google's servers at all. But, corporations can always use a commercial version of Gmail if it were to exist.