And it makes sense to me that a business would leverage that data in ways to benefit themselves.
Big fat nope on that one. This is exactly what the GDPR is about. I’m giving you my data for a specific purpose, and unless I tell you otherwise, you have no fucking business using that data for anything else. Gonna be interesting to see how this one plays out in the EU.
Are you seriously equating security software running on business systems with state violence / surveillance on people? Those two things are not even remotely comparable, starting with business systems not being people that have rights