Maybe for bad actors. I work for an U.S. company and we were explicitly required to get opt-in by the compliance officer. And it's messages users actually want to get (we have over 99.9% opt-in).