Old meters are often destroyed for security reasons and to help prevent fraud, but the components do get recycled responsibly. Even if a removed meter hasn't yet been destroyed, you still won't be able to get hold of it either I'm afraid. Removed meters that get booked in for destruction are retained only temporarily until the final meter reading has been verified and some other paperwork taken care of. After that, it's straight to the chop shop unless it's being recalled to the warehouse or manufacturer for some reason.
My friend Blastoise186 is a cybersecurity guy himself and he's pretty confident it's all safe. Firstly, the surveillance with a smart meter is basically non-existent in the UK. If you set it up in Monthly Mode then it only sends basic meter readings once a month and barely anything else unless there's either a firmware update currently going through, or some kind of alarm/alert is triggered such as tamper detection. They only usually speak when they're spoken to first and will only accept valid SMETS Commands, anything else gets rejected.
As for security, it's pretty tight. It's all running on a closed system that's pretty difficult to compromise - otherwise the NCSC would have picked up on it and ordered it to be fixed. There's more details at https://smartme.co.uk
in case that helps.
As for what suppliers can do? Ofgem regulates ALL of that stuff. The rules surrounding remote disconnections are the same as any other kind of disconnection - and in fact pretty much all suppliers in the UK have revoked their ability to use that power for safety reasons. They will never just disconnect someone remotely because there's no way to know if you rely on your supply for something that's safety critical. Likewise, the ability to remotely switch your meter from Credit Mode to Prepayment Mode is heavily regulated and is never done without your knowledge. If it's being done due to debt collection, you'd have had tons of warnings first and a lot of chances to pay the debt off and the alternative would be that the existing traditional credit meter gets ripped out and replaced with a smart meter in Prepayment Mode anyway. For obvious reasons, switching from Prepayment Mode to Credit Mode isn't quite as strictly enforced, since that will not cause the supply to self-disconnect as a result of running out of credit.
Ultimately, you'd just be delaying the inevitable at best. There will be a time when smart meters are the ONLY type still available and as all meters have a limited service life, you'd be forced to upgrade eventually anyway. At this stage, it's quite possible that we've already passed that point of no return, since the older meters are no longer being manufactured for use in the UK.