After my opinion, a theme that is installed on an existing website with content, settings, menus etc. should never mess with those.
The Twenty Tweny-Three theme does not add any new content (Post/Page/Media) on activation. Here’s a video of a sandbox I setup to test this: there’s no post, page, or media before and after activating the TT3 theme:
In fact, no theme installed directly from WordPress.org should add any dummy content, unless you install and activate a companion plugin for that specific theme and import one of its starter sites.
Can you provide an example of a WordPress.org theme that adds sample data automatically?
As for menus, settings, and whatnot… these are features that are dependent on the specific theme. A WordPress theme can have only ONE theme active at a time. So if you activate a new theme, the old theme, along with its features and settings are deactivated, and the new theme’s settings and features become active.
So, by definition, changing themes should set these features and their settings to the defaults defined by the new theme, while the old theme and its features get completely deactivated.
Again, I like to test out a theme from WordPress.org that added such sample data as you describe (post, pages, media files, etc)… other than the default configuration of the new theme’s settings.
As for custom or commercial themes that you need to UPLOAD before using, WordPress is an open-source project, and there’s no way to technically control what code users upload to their site and what that code does. (Actually, there can be technical restrictions to prevent this, but whatever controls you put in can as well be easily removed by the custom/commercial theme’s developer… because, again, this is an open-source project with all the code open for anyone to completely change as they wish.)