If they should or not is not the question. The fact that they can is already a read flag that WR should not use these tools/services. Either it can be proven to be encrypted with not possible access or it must be local only. All other cases we consider everything shared as public information that can be sell, used and manipulate for any purpose.