Well, it is an opt-out feature, which is already a way to purposely collect data if you're not playing attention enough. Plus, if npm has such flaw, this is still no excuse for Core to do the same.