Every time someone argues that people can avoid the privacy problems of Facebook by simply not using it, I point out this issue (plus the shadow accounts).

The difference between malware and "legitimate" software is whether there's a "legitimate" company behind it and whether that company has a "legitimate" interest in the information. Sad but that's how it is. Just like how governments give themselves the right to crack computer security and surveil everyone but throw citizens in jail if they do the same thing.