Just because not many people use a package, doesn’t mean it is irrelevant. For open source packages (or anything really), as soon as one additional person uses a package, that package becomes relevant. The person/people using it become its advertisers, and when enough people are seen using a product, especially a free one, a larger group will use either that package or something similar to cut their own programming costs.
This is simplified, but the point is that we need to stop this sort of thing at the root (the package itself) before it gets noticed by larger groups and companies who might actually get away with this BS. Always remember, we are tech/privacy nerds. We are the minority, and the average person doesn’t care until something hurts them directly.
I kinda wanna try Gentoo just for the experience, but as someone who already uses Arch, I’m worried it will take up more of my time than my current setup already does.