> They have every right to do that just like for example a privacy friendly website (or distro) can provide a package/installer with defaults that are privacy friendly for example.

Everything you are saying makes sense if you are talking about controlling the defaults of the software maintained/installed by the package. That's not what is happening here.