“A bug in the SSH integration feature caused input and output to be logged to a file on the remote host.”
iTerm2 versions 3.5.6 through 3.5.10 wrote SSH session input and output to /tmp/framer.txt on the remote machine. Other users on that host could read it. Upgrading the terminal does not delete the file. You have to go find it on every server you touched.