[acdha]

It means exactly what it say on the tin. This isn't a hypothetical, either, but a class of behaviour which has happened repeatedly in the past. Here are a few examples of things which the FCC & FTC eventually stopped; there's zero reason to believe that this behaviour won't resume as soon as it's safe to accept that money.

Large ISPs like Verizon altered HTTP traffic to inject a unique identifier which linked all of your traffic across devices and sites and sold a service linking those identifiers to demographic information. Even without paying, you could use that to reliably link user activity across every plain-text HTTP service:

https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://arstechnica.com/security/2014/10/verizon-wireless-in...

Going further back, a number of ISPs got heat for reselling access to customer activity to various tracking services:

http://www.washingtonpost.com/wp-dyn/content/article/2008/04...

Another interesting allegation came from Andreas Gal after he left Mozilla, claiming that Google's competitors were paying ISPs for copies of user's search activity so they could improve their search engine by using ranking closer to Google's. Given how many people search for sensitive or identifying terms, that's already a concern and, again, there's no reason to think companies with very limited competition won't expand their profits if it's safe:

https://andreasgal.com/2015/03/30/data-is-at-the-heart-of-se...