Because they're the exception, not the norm. These systems generally do what they're supposed to do, at least if implemented correctly. The key isn't efficacy; you need to be emotionally prepared to oppose privacy violations even if they're doing exactly what they advertise.