These tools are very common in non-nefarious ways for troubleshooting networking, and while vendors set up to serve this space solely as troubleshooting tools, I've also built my own that can sit on a network link and monitor for problems.

In my case it was for mobile wireless signaling traffic (all the coordination for creating a mobile internet connection, handing the connection off between towers, etc), and I'd credit it as one of the reasons you're mobile internet connection is so stable. When LTE first came out, myself and many others solved all sorts of bugs in the equipment and protocols by using or building these sorts of tools.

Port mirroring is the network engineer's equivalent of using breakpoints in a debugger for a programmer. It allows you to inspect what happens on the wire to get a clue for what's wrong.

It does sound bad the way OP described it, but packet or HTTP mirroring is a standard feature of A/B testing and blue-green deployments of a very critical code. Mirror traffic between version 1 and 2, then compare response body, response time and return response A to the end users.

Nah, packet mirroring is a standard networking feature and ideally every feature is line rate.

There are companies that mirror their traffic to storage for a few days to be able to look back and troubleshoot issues. ALL their traffic, proactively.