Just like Facebook and Twitter claimed they wouldn't use 2FA phone numbers for advertising and did anyway?

It doesn't even have to be malicious, it can happen accidentally. If the entire company is based on advertising and privacy violations then it's hard to truly have "private" data without building an entirely separate system in parallel, otherwise you could put your data in a place you think it's private, not realizing some other component of the system will use that for ad targeting.