would it be surprising to a user if they received an email from a company they hadn’t given their email to?

if yes, it’s a dark pattern.

if no, it’s not.

i side with, yes.