Taking a privacy policy at its word is not really "protecting privacy", in my opinion. It's just thinking that as long as they pinky-swear, then there is no privacy issue.

Even if the company intends on adhering to the policy, the policy does nothing to protect against that company itself being hacked.

It still represents a risk.