Nothing in the GPL prevents such uses.
Sure, they can produce a video player full of spyware and then give the source of the spyware to their users, but then, that would render that spyware useless as soon a anti-virus got their hand on it. Not to mention, users would avoid the program as the spyware would then be known.
Only users can keep themselves safe -- developers can't.
Or are we so jaded that we think every contracted company to the army, and every sub-contracted company being payed for a job by the NSA/CIA/FBI regularly go around and breaks laws because the think "hu, why not, my boss is the goverment, they wont mind!".