Re: It's been said many times...
It's really bad when the paid for version still nicks your data.
"If you're not paying for it, you're the product" is still true; but now you're also the product if you are paying for it.
And not just in software / web / IoT land. You pay for cell service, cable / satellite / streaming, buying products in retail stores, etc. etc. Those companies all happily flog private and sensitive customer data to anyone who puts up the cash, regardless of whether you participate in their so-called loyalty programs.
Note also that GDPR was in full effect when Avast (an EU-based company) pulled this crap. They might get some kind of token fine eventually, but clearly GDPR was not a deterrent.
Bottom line: assume that you're always the product, unless you can prove otherwise.