If you take Dr web for example, it lists personal data and statistics, what do those mean?
Any information a virus can collect.
If it can scan a drive (like most downloadable AV software), then it can read that same data.
If it hooks into the operating system (like AV software with more advance features), then it has just as much access as a trojan.
Be very careful with what software you give admin rights to. In addition to that, software with kernel level access can do things that an OS might not even let an admin do.
If an AV only has permission to scan a single file (like website-based AVs that scan individual uploaded files on request), then it can still collect personal data in that file. (Names, email addresses, passwords, etc. And maybe meta-data.)
Does company X exploit or over-collect my data? isn't a question that is realistically answerable. We don't know everything proprietary software does on our computers. We can't tell what a business does with the data it copies from us. (Even if we could there is no way to know if that data will be exploited in the future.) Nor can we know whether the data they have about us won't some day get leaked to another party.