The web is what I know well, this may not be true in other areas, but the W3C has a long history of being hostile to end users, ignoring privacy, and pushing corporate interests over others.

Following their recommendations and doing things just because they were in the spec does make those decisions ethical or even legal. Developers have an obligation to push back against standards boards and corporations that make bad decisions.

Hiding behind the business rules or the standards committee is completely unacceptable anymore. Especially when it comes to bad security/privacy practices that generally favor a market over an end user.