They did, but those companies who don't do it today are doomed to fail because the other companies that do will sell more, including both products and users' data.
Well... if the company's main activity is refining oil, cultivating corn, or trawler fishing, then maybe it doesn't need to buy and sell user's data, because, you know, there aren't any...
Also, there are companies like FairPhone and System76 that (probably) don't buy and sell user's data. But they aren't exactly thriving.