Unfortunately, everyone who used their service did agree to it. Directly from their Privacy Policy:
Commonly owned entities, affiliates and change of ownership
If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction and this Privacy Statement will apply to your Personal Information as transferred to the new entity. We may also disclose Personal Information about you to our corporate affiliates to help operate our services and our affiliates’ services.
https://www.23andme.com/legal/privacy/#data-sharing
Whether this will hold up in court is a bit murky. But without a large, laborious court battle, they can and will sell the data and they are "legally" allowed to
I definitely agree with your second point. And I find it ridiculous that a company can ever claim to "own" your genetic information. It's why I've never dared sign up for any kind of genetic ancestry sites. I can't give that personal of information away for free, let alone pay for it to be taken