Beginning to think the reason security is so difficult is because ostensibly "good" companies do everything an attacker does and worse, but under the guise of EULAs. Here's a thought experiement: If Facebook were malware, could you get rid of it?
"Facebook invades privacy" is still a minority opinion among their user base (whether we like it or not).