First of all, there are lots of things stopping them (systems permissions, checks, organizational rules, etc). All might be circumventable -- but to claim they don't exist is ridiculous.

Secondly, intent matters. Killing a person can be a pure accident, can be manslaughter, can be first degree premeditated murder. You might attempt to dumb it down to "It doesn't matter, the person is dead" -- but that isn't how the US legal system, or the majority of people think.

If the intent of a system is to allow the profiles to be read by people (or shipped to government) that is very different than if the intent it to be exclusively used by software.