It doesn't have to be CEXs doing it at the highest operational level, but one corrupt employee is enough for the user base to become public.
This is not specific only to CEX, but also to all other services that collect user information for any reason. I remember that the same case with the corrupt employee happened at CMC. The email address I used there was flooded with new spam that same day.
CEXs are unfortunately a necessary evil, although alternatives exist and people should use them more.
I think the basic idea is CEX as a trading platform, everything else is additional features. It is something else entirely that people are lazy and use them for other things because it is easier for them to manage their assets from one place.