…during the course of that person's work duties, for which the company, therefore, owns responsibility. Literally every single thing any company has ever done wrong boils down to "a person made the wrong decision."
> i don’t make purposeful email addresses; i don’t have time for that.
Yes, but security and privacy researchers make time for this specifically to validate whether companies follow their own privacy and usage terms as well as to quantify and gauge the risks in interacting with a company, such as the risk that the company will misuse that information or the risk that the company may be breached, resulting in user account details being used in attacks against the individual users themselves.
It's fine if you don't do any of this or, for that matter, if you don't even care. But don't belittle the work when you don't understand the reasons for it.