In my opinion the sale of phone location data is already unethical on it’s own.
The location data was pretty accurate too in suburban areas. And the provider in question was not very good at anonymising it either. On multiple occasions we could track individuals over a longer period of time. Which would shut down the entire project until it was fixed.
So the company did the right thing whenever the data was compromised. Probably because they were publicly traded and had a good name. I doubt scrappy startups would do the same.