The folder Data was created by macOS automatically for ALL apps that are sandboxed properly.
And sub directories (Desktop, Downloads, Pictures etc.) are not copies, they are symbolic links (alias) to your actual data folders.
Sandboxed apps can only access files inside its Container, and for Core Tunnel, it's ~/Library/Containers/io.coressh.tunnel.
macOS creates these symbolic links does not mean sandboxed apps have permissions to read/write on them, sandboxed apps still have to ask users for permission explicitly.
If you browse other folders inside ~/Library/Containers, you wouldn't be surprised that all of them are sharing similar directory structure as Core Tunnel.
It's a particular of sandboxing technology and has nothing to do with copying your data, actually, your data is much safer after Core Tunnel sandboxed and Hardened Runtime enabled.
I hope this explains 
Yang