I had a much longer comment, but it eventually detracted from this point: you can't guarantee where that data goes, how it's stored through its life, etc.
Inappropriate usage of PII can lead to severe consequences in most western countries.
We can clearly see where the incentives are aligned.
Facebook still being around shows this is just wishful thinking.
Also, be careful, the concept of "ethical frameworks" is used by companies to become their own judges and jury.
Sure, it's definitely a security risk.
However there is a strong line betweeen a first party spyware that collects data to sell, and the malware discussed in this article, that was specifically places there to try to steal your credit card or banking info for criminals.
I'm fine with legal penalties for the manufacturers in both cases though.