True. But in practice, a software company that's making money from users has a lot of incentive not to harm their brand, or open themselves up to competition, by being shady.

It does happen but users are waking up to the problem and companies are learning.

Well I'm assuming things like this helps:

  We do not share nor sell your data.

https://www.obdev.at/privacy-policy.html

However you may be referring to the same notion that nothing stops someone from murdering someone else.

Until the company is acquired. And then the disclaimer disappears silently.

Which... has never happened with the company behind Little Snitch.

And it never happened to every other company that has been acquired...

Outcomes from such clauses also hinge on whether metadata describing the operation of their system - such as logs showing who communicated with who - is your data, or their data.

Following recent changes to law here in Australia, for example, metadata is essentially the property of the state.