The issue is that everyone's burned out by ridiculously long overly-broad EULAs written in impenetrable legalese. The general sentiment even, here on HN where people should know better, is "sure, they SAY they can do those things but (it's just boilerplate | they wouldn't really ever do that stuff | they really just meant this much more benign thing | they need that access to provide the product | it helps them debug problems)". And then people act all shocked when, once again, a company does precisely what it told you it was going to do.

A classic example is the "we collect your data to provide X service" / "you can disable service X" that we see all over the place. Everyone reads it as "you can disable data collection" but that's not what it says, and it's not what really happens.

The better alternative is to not accept this kind of invasiveness but the ease and convenience of giving in is too seductive for most people, so we invent a comfort belief that it's somehow benign or at worst irrelevant.