Clarification needed. When you say their commitment has been limited, do you mean they have done things that go contrary to protecting data (like selling user data to ad companies, or handing user data to government agencies when requested) or that they haven't actively taken a stance for protecting customer data (such as duckduckgo's promise not to track you, or Wikipedia's promise to stay donation-based).

I suspect that corporations have much more leverage in this than consumers...

For US corps maybe, but many foreign companies also use dropbox even though they have little to no leverage in the US.