Agreed. There's an implicit expectation of ethical conduct placed on AV vendors that other companies don't possess. They shouldn't be able to claim to be protecting their users data then turn around and sell that exact same data to the highest bidder.It's an AV company, not a marketing company.
It's not fair for the normal user that simply click next next for installing an AV hoping to be PROTECTED and not just another company selling your data just because you don't read everything (and they know the normal user don't read everything, they take advantage of that).
You're right, maybe it's not illegal, but it's at least unethical since it's a company made to protect you and your data, it doesn't matter if they are not selling the data to hackers, but just the act of selling it's not fair.