> if they wanted to steal your data, then they'd ask you about it?

Because if they don't meet a bare minimum of decency and regulatory requirements, they will be fined a substantial % of their revenue.

They ask questions because if they didn't they wouldn't have a defense in court.