Yes, you have to turn in your broken phone to Apple to get the OOW swap pricing
Re: private data.
1--As a person who does data recovery every day, what I would say to you is----your data is boring and we can't even be bothered to take 10 seconds to look at it. Everyone's data is pretty much the same: amazing sushi, kids at the beach, birthdays, Grindr selfies, snapshots of recipes, babies, snowman with a *****, texts of meeting up later, setting up weed deals, standing by a waterfall, excepts from the bible, strings of account information and thousands of pictures of dogs.
2--Is your phone protected by a passcode? If yes, then you're safe. Apple can't crack a passcode any more than you can.
3. If your phone is not protected by a passcode, then I suppose it is possible that your phone could end up coming to life again one day, depending on what Apple did with it. I can't see them attempting to repair a wet board, but it is possible that it could be sold as eWaste and that someone else could buy it. I ended up reviving a phone I bought on eBay years ago and it had newborn hospital baby pictures on it. I contacted the owner and risked freaking her out because I couldnt bear to delete them in case they were precious to her. They were. She cried. She claims to have turned it in to Apple, but my guess is that it was a carrier store.
4--My guess, purely as a consumer, is that Apple would have some seriously good data destruction policies. Can you imagine the hullabaloo that would erupt if the kingpin of mobile device security was actually looking at customer data from trade in phones? That is not a risk I can see them taking. Your data is boring, and the cost to extract it would be more expensive than anything your data could provide.