The risk arises when the information is organized and aggregated. Police aren't going to hunt down one guy whose name was on a gum wrapper. A register listing actionable contact information for five hundred clients is far more interesting to a vice detective.
And while a malicious driver could do anything, let's assume no one is malicious. The driver doesn't need a detailed booking record, he only needs to know where he is going today. The escort is also unlikely to make detailed records.
As for why they keep it: because they don't know any better. Negligence, not malice.
Why don't we assume that agencies aren't malicious either. Also, you under-estimate drivers. They have smart phones too and will use them to store info (I've forgotten SP room #s myself when I resorted to my memory, or lost a piece of paper in a dark car interior).
Many of the reputable ones have already made their websites and advertisements C-36 compliant.
Don't you think they have a good reason not to archive unnecessary information, which in turn, can be used or tried to be used against them too?
(While I'm all for the purging of unnecessary or outdated booking records, info such as a hotel room # or a phone # is not prima facie evidence that an offence has been committed under C-36).