Post types are not only intended for front-facing content, they can be generic content objects you can use for lots of purposes.
If you’re concerned with data being exposed, there are a number of arguments available for controlling whether the items can be queried from the front end, appear in search, have UI for managing items, can be added to nav menus, etc.. You can hide a post type entirely- front and back end, and only expose it via your own plugin code.
The advantage to using a CPT is that you get the API along with it to help speed development of your plugin, and taxonomies and meta data can be used with it and similarly hidden.
Other plugins may use their own tables for storing data. You can use the wpdb class to do whatever database operations you need with custom tables and data. I recommend exploring if native objects can cover your needs first, but sometimes you just need your own tables, like if you want many-to-many relationships, or other complex structures.