Basically, the scoundrels don't trust other scoundrels. That's what's saving us from getting server-rendered first-party ads on most websites, that would make adblocking much more difficult.

A lot of firms (maybe most?) which buy this data actually don't care about that much as long as you can otherwise demonstrate the data is valid. If the data is predictive over time, it's valid, and most firms will happily accept that demonstration (with the proviso that they cease working with you once the data loses predictive value).

The reason the apps use those SDKs directly is because there's a hierarchy of resellers. The app developers themselves are lazy and typically want the SDK functionality which is provided free in return for their users' data. They're not always in the business of selling data themselves, they're just ambivalent.

Then the SDK providers abstract their own involvement in any particular app while still getting data.