We definitely need some scenarios where this kind of spying plays out badly for the user, so we can use them in arguments against these practices. Without examples, I can't blame users for calling these dangers hypothetical, really.