Well there was the well publicised man-in-the-middle attack by Linkedin.
They repurposed user login details to silently rerouted all the user’s email through their servers for scanning and mining.
That seems like a pretty dark pattern to me. To my knowledge no one got fired for unethical behaviour over that.
The company seems to have a “don’t get caught” attitude to privacy.