I would argue that credit bureaus leaking all your information to criminals and then charging you money to protect you from those criminals is also criminal fraud writ large.
Equifax is just as shady as those lenders - more so IMO because they have absolutely no obligation or business relationship directly with the individual's whose private data they compromised.
Why am I supposed to take it as a given that if these organizations use the info it must be useful, then?