I completely agree on your first point.
However on your second point you seem to be confusing two different things. There's two different systems that you're lumping together as one. The one you're talking about is LADD. Discussed here: https://www.faa.gov/pilots/ladd
FAA even caveats themselves:
> ADS-B Out transmits flight data directly from the aircraft to internet vendors not participating in the LADD program. Non-participating internet vendors collect and post all ADS-B Out flight data on the internet. To address ADS-B Out privacy concerns, the FAA has initiated the Privacy ICAO Address (PIA) program to improve the privacy of eligible aircraft.
Now to your point, you're incorrect. PIA, as mentioned in that quote by the FAA, literally changes the aircraft's ICAO number to a new number and delists it from public registries. Using an SDR or the data from ADSB Exchange only gets you that psuedonomynous ID. Once that's changed again you have to stalk someone by following them to the airport and align the takeoff time of when you know they left with the new ICAO number. That's the ethically/morally/legally quesitonable aspect about all of this.
More here on PIA: https://www.faa.gov/air_traffic/technology/equipadsb/privacy
> In order to mitigate these concerns, FAA has initiated the Privacy ICAO aircraft address program with the objective of improving the privacy of aircraft operators in today's ADS-B environment by limiting the extent to which the aircraft can be quickly and easily identified by non-U.S. government entities, while ensuring there is no adverse effect on ATC services.