This is one of those occasions where Apple is really on the hook to offer some sort of technical explanation of what’s going on here. It’s entered the realm of a trust issue.
I am sure this is also a GDPR violation and EU is probably already looking into it.