They should have asked before they clicked buy-it-now but I don't see why you shouldn't give it out. The buyer most likely wants to check if the phone is locked or unlocked. There is not much else that he can do with it.
They want to make sure it isn't iCloud locked and it's unlocked to all carriers (if you sold it as such). There really isn't anything they can do with it to negatively effect you. It's basically like a VIN check on a vehicle.