I’m just wondering if the sqlcmd.exe has client-side telemetry Telemetry, or CEIP or any other form of spyware baked into it and turned on by default? And if so how to turn it off?

The software enables Microsoft to collect telemetry by default. You may turn off telemetry at the Server and client levels by following the instructions at http://go.microsoft.com/fwlink/?LinkID=733886. There are separate controls to turn off telemetry at the Server level and the client level. If you turn off telemetry at the Server level only, Microsoft will collect telemetry through the client level unless you also turn off telemetry at the client level.