You’re assuming they actually understand proper data protection procedures. You have a very misplaced amount of faith in the knowledge of the average person. Plenty of people just expect stuff to work and are horrified when they realize they’re not.

I saw that all the time when I worked in mobile phone sales/support.