I'm pretty certain that my data would be leaked regardless of him, so as far as objectionable businesses go, his is pretty low on my list of ones to be upset about

In some sense companies that don't protect your data make money off the back of your data being leaked (in the sense that they saved money by not spending it on security)

And police officers make a living off of crime; ambulance personnel wouldn't get paid if nobody got sick or injured. What's the point of that observation?