> have probably thought about their data protection terms

Maybe. In my experience working with legal tech, a) lawyers are not as resistant to the ToS click through reflex as you might think, b) data privacy is often 1 step too abstract for people without subject matter expertise to usefully reason about, so marketing phrases like “enterprise-grade encryption” or whatever are more influential than one would hope, and c) these things are often considered more technical problems than legal problems, so reliability, lack of downtime, server-level security, and more traditional concerns like that likely take center stage.

I have no idea if that’s what happened here, but it wouldn’t surprise me at all.