Yeah, seems weird, but there's also points where it's not related at all.
One is a company using user data they didn't tell they would use for this purpose, and illegally trying to do it anyway. They literally sell the data by making a product of it. It's also a private company with stakeholders.
Other is EU scanning messages, but not selling them.
So it's about who you trust basically.
5 people could do it though.