Is there any sensitive data in the Configuration Management Export?
Well, it contains the complete configuration, like list of modules, views, roles and their permissions.

While those things are not directly sensitive, it would make it easy to check for misconfigurations for example, views that aren't access protected, roles that have administrative permissions and so on.

I'm not sure if core adds anything that is explictly sensitive in there, I don't know any examples.

It does depend on the modules you have installed though. Many sites store API Keys or passwords, when integrating with third party services. Those would also be stored in configuration. For example configuration to send mails through an SMTP server or username/password for a Solr server.  And you don't want to have that public.

But you probably also don't want those in git in the first place. You can solve that by setting them through configuration overrides in settings.php.