They don't need to sell that information to be untrustworthy, they just need to lose it.

That...already happens though.

https://haveibeenpwned.com/

You can look up a vast majority of places that you have likely lost your login information from.

Like my point here is you'd have to drop a lot more than just windows to be safe from this.

Yeah, you have to trust places that have login information. And you can't quite avoid that unless you stop using the internet. Best you can do is minimize the damage with stronger passwords and not sharing passwords across sites.

But my point is this analogy is trying to make something heavy out of something that we've already had to deal with since the dawn of the internet.