I'm more concerned with the data they receive being leaked or sold.

And by most websites I guess I meant large ones that people frequent every day, because these days it's almost impossible to have any sort of useful DDoS protection without using such a service.