They harvested the data about users without their consent. This is about users wanting to protect against said data collection, so I think your angle comes from the wrong perspective and the juxtaposition (Which way is it?) is wrong.

> Should they let people do whatever they want with their accounts

That CA didn't have the consent of users was the scandal.