Oh, but they did, and quite infamously :D
https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...
https://arstechnica.com/uncategorized/2005/11/5549-2/
https://www.networkworld.com/article/715376/network-security...
https://www.researchgate.net/publication/240779158_Lessons_f...
I still refuse to buy Sony labelled products from that one. When you have to go through several dozen computers to wipe their rootkits off... even though creating a custom deployment image was faster, it was still a massive time consuming pain I'd never put on anyone.
If they'd have released a simple, single download, then maybe I'd have been less burned... but having to install custom uninstaller per machine, with an email address, and that software itself left another security hole... I'm out.