Why should businesses get a pass but not normal users?
Because businesses buy in bulk. Regular users have to make up the difference by trading in personal data.
Couldn't someone set up a "business" that proxy-buys for a large number of people? There's obviously a decent market for non-facebook-login version of the Quest 2.
I'm guessing that will be against the TOS and those devices would be remotely bricked (but that's just conjecture)