You're right, but "selling people stuff" is a secondary source of profit. Surveillance too. The truth is, users become profitable far before they ever pull out a credit card, and the goal isn't the credit card, it's the user itself.
To target an ad for a product, you need an interest-based profile on someone. To build that profile, you need data.
To influence public opinion (as has become so popular for politicians and intelligence departments), or if you want to monetize an emotional reaction (like the NRA or PETA) you need a psychological profile, or a way to extrapolate one. Again, data.
To prosecute crimes, you need communications and location data (this is what most would call "surveillance"). Law enforcement (state and federal), private investigators, state departments are all customers for this. The market for this evidence (both what can and can't be used in court is harvested; look up "evidence laundering") is an unending stream of income, for the same reason as all three of these, and here's why:
If you're Meta, or Google, do you want to be performing this psychological profiling, or scanning every message for "incriminating" keywords, or tracking specific users' locations? Absolutely not. That would put your company at fault. So what do you do? You sell the data itself, unspecified, en masse. The FBI approaches you to implement a service that you can query for real-time location data? Hell no, buddy, that'd threaten the whole company! Go do it on your own servers! Pay for the data and compute it yourself! (Or pay for just enough processing to get what you need without us knowing what you're using it for, which is what op's link is about)
And that's exactly what happens: the data itself becomes the product. Then, the goal is to harvest as much data as you possibly can. That's the business model.
Product sales are not the aim. The people are what is sold.