They aren't mutually exclusive. In particular, the very fact that a manufacturer tried to do something covertly as part of another system the customer authorised would potentially make their actions a criminal offence where I am, as it clearly becomes unauthorised access and not merely a privacy or data protection issue mostly likely dealt with through regulation or a civil court.

I can't help thinking that the world would be a better place, and one with a lot fewer of these shady behaviours, if the individuals who were knowingly and deliberately arranging them at each company were personally on the hook for that criminal conduct, and not able to just turn a blind eye and rationalise the abuse away because their employer's lawyers could handle any consequences.