They are now, although to be clear there was (is?) nothing nefarious going on, just people not understanding that public submissions are available to VirusTotal's paying users. These days VT has private scanning, too, but the issue was always one-offs from random finance or investor relations teams.
It's come up here and there in security, too, e.g. in https://www.directdefense.com/harvesting-cb-response-data-le....