[BobaFloutist]

To be fair, the Oxford semicolon might be incorrect here if they intended "copyright and IP violations" to be paired.

e.g. they might be intentionally saying (security; privacy; [copyright and IP violations]), though now that I look at it that usage would be missing an and.

[hunter2_]

I'm fine with an implied "and," but I disagree that "violations" is scoped only to the final item in the series. It's clearly transitive to each item in the series (security violations, etc.). That said, your point stands that the phrase "copyright and IP" could be the final item in the series (with an omitted "and" at the series level) rather than the final two items, although there wouldn't be a compelling reason to do that in this particular case.