Someone would have to make specific JS to target your specific app/service and specific users, as well as in some way "launder" the stolen data. Totally differe

Someone would have to make specific JS to target your specific app/service and specific users, as well as in some way "launder" the stolen data. Totally different 'order of magnitude' from automatically and legally taking the users' data. I hope this is the correct way to evaluate these kind of things?