> No, surveillance and ads aren't "threats" in and of themselves.

You're right, a threat is potential damage, these things are done damage.