"We didn't design for for scaling overnight" is different from "we did care for security until we got caught"

However small or big, a company shouldn't be selling data without user consent, shouldn't use terms end-to-end encryption while make otherwise claims.

This behaviour should be punishable

Facebook did that (e.g. https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana..., funny stuff they did to circumvent GDPR). And Who cared? There was some noise in the media and that's all. Was Mark Zuckerberg punished? For me all this Zoom bashing looks a bit as if those guys stepped on someone's toe, who does not like the idea of having another competitor in the social media/online advertising area.