[underpand]

Yes, there are a lot of malicious actors that actually sell data (apps, browser extensions, phone carriers, potentially ISPs, finance companies, etc.). Many of these actors even sell un-anonymized data. The big tech companies are very low on the totem pole of badness and will continue to stay that way for a long time because the incentives don't align for them to actually sell data.