So, ability to commit a crime is illegal? Did I miss something in this article?
It is the websites that invite them into a secure context that are often illegal.
In the physical realm, is it okay for an advertising company to be invited into a bank safe or customer records storage without any business controls to audit, monitor or check their actions? Same is true on websites.