It's good work. Ultimately though we cannot base civic cybersecurity for the entire population on groups like NOYB or any number of vigilante policemen exposing malevolent companies one by one. It's neither scalable nor sustainable against a tide of technological abuse enabled by a culture of corporate entitlement and public apathy.

In addition to legislation the problem requires active programmes of public education and information as is the case for all other public health or security issues.

More lives are saved per dollar running a "Don't drink-drive" campaign than giving police money to arrest drunk drivers.

"Don't install that app" should be a tag-line every mother and child knows, like "See it. Say it. Sorted.", just to get people to pause and think... "would I share all my all my personal data and access to my life with a random total stranger?" Because that's what you're doing when you install some dodgy app at a restaurant.

Maybe groups like NOYB could do more work on sophisticated modern influential media to attack the root cause of the problem: a fundamentally flawed security model with a set of wholly inappropriate assumptions.

Change the assumptions.