I say this as a fan of a lot of what Framework is doing.

Lets not pretend we do not all -know- virtually every SaaS sucks ass at security because it slows down sales.

Companies that use these easy button services anyway are knowingly putting PII at risk and any liability should fall on those decision makers.

If you do not have the security and infra staff to take user data in house securely, in highly auditable secure enclaves, then you should not store it at all.