It's an AV company, not a marketing company.
It's not fair for the normal user that simply click next next for installing an AV hoping to be PROTECTED and not just another company selling your data just because you don't read everything (and they know the normal user don't read everything, they take advantage of that).
You're right, maybe it's not illegal, but it's at least unethical since it's a company made to protect you and your data, it doesn't matter if they are not selling the data to hackers, but just the act of selling it's not fair.