[jacobr1]

At a certain point, you need some basic level trust do business with anybody. Regardless of what the ToS say, the company could do anything with the data. Even supposed E2E encryption has often been found to be either not really be encrypted, or unintentionally vulnerable.

Our whole system is based on assuming a degree of trust, based on both social norms and reputation of prior interaction, with a confidence of remedy in the case of a failure. If we really had to have much stronger confidence up-front in commercial interactions there would be a lot more friction and overhead in every transaction. Dealing with the occasional fraud seems like a better tradeoff.