I just don’t get how the risk/reward works out in their favor.
The uproar if their malfeasance is detected is far more than the value of any information they would gain.
Wouldn’t it be far simpler and more direct for them to go to Google or Facebook and ask them to hand over everything they have on you, at which point those companies almost certainly comply?