You were downvoted but this is spot-on, and you see this debate happening everywhere in tech. The entire GDPR was rooted in the (correct) observation that the tech sector could not self-regulate, that actual laws with nontrivial punishment were required to force tech companies to stop shady behaviors.

Even YC isn't clean in this regard. They funded a startup called InstallMonetizer that promulgated the drive-by installer problem: https://news.ycombinator.com/item?id=5092711 . There's a great quote from that post:

> You can make a lot of money doing all kinds of popular things -- pimping women, selling drugs, selling 'likes' on facebook, selling botnets that create fake clicks on advertisers, ponzi schemes, etc. Some are illegal, some are just barely legal, but they are all damaging to someone. This line of business is known as 'scummy' and InstallMonetizer is plain 'scummy'.

Yes we have to blame those who perpetrate the behavior, but we also have to blame ourselves for not being more aggressive in sounding the alarm. For many influential people who could have put a stop to this, the Upton Sinclair quote applies:

> It is difficult to get a man to understand something, when his salary depends on his not understanding it.