I do agree we need government regulation[1], but as perhaps a bit of defense in depth, I absolutely think we need to be instilling engineers with ethics. Would your point make any sense if we were talking about doctors, instead of engineers? We teach "first, do no harm" from day one in that field, and we wouldn't assume for any act a doctor would refuse to do, one that would is readily available. We need the same for software engineers. We need to teach people that their mere paycheck job could incite a genocide on the other side of the world.
I also dislike the "someone else will take their place" logic. While a large number of jobs are, indeed, trivially replaceable, many are not, and many developers have significantly above average skill. Some believe they act ethically, and some do not care. If we can remove those who wish to act ethically from working at unethical companies, we significantly shrink the job pool for them. They'll have less options, and likely have to fight harder and pay more to get them. This means that unethical companies may be paying more (i.e. lower profit margins) and be getting worse talent.
If we can get more of the most talented developers working at more ethical companies, the more ethical solutions will be better, and they will win in the market.
[1] I am a big proponent of GDPR and a desire for a US version of it. Though ultimately, particularly in terms of government surveillance, I feel we need a Constitutional Amendment defining a right to privacy. Something far more lasting and enshrined into our future legal framework that recognizes that privacy is a fundamental human right.