It seems that various JSON configuration files are easily viewable by requesting them with a simple GET request. Some examples of these are:

• matomo-domain.example.com/plugins/AbTesting/plugin.json
• matomo-domain.example.com/plugins/CustomVariables/plugin.json
• matomo-domain.example.com/package-lock.json

Some various files I've observed:

• composer.json
• plugin.json
• package-lock.json

There could be useful to an attacker trying to monitor the patch version of Matomo sites, so the access settings should be made less permissive so that JSON files aren't as open to the web.

A useful command to enumerate over these from the core project is
find ./ -iname '*.json' | egrep -v '(vendor|lang|node_modules)'