Not all of them are conspiracy theory. Facebook was using a "free VPN" app to MITM and read all of users web traffic, including HTTPS. Google had to change Android key management to hardcode the browser keys so nobody would do it again