Most people's data is being sold. No reason military people would be exempt.
The reason is twofold: 1. Servicemembers hold security clearances and thus access to critical things. 2. Leaked PII is a national security threat. This report, I'd argue, is good 'marketing' for the very real need for privacy protections nationwide. The U.S. military is, despite its best efforts, still an admired and respected institution.
As for your second point, big shrug. All the data is already out there and isn't going away anytime soon. Best case is to protect future data from being leaked, but the US isn't going to outlaw data brokers anytime soon and holding companies with poor computer security practices to account is very recent.