The big difference is that the IRS employee selling your data is illegal. So sure, your info can still end up out there in less-legible circles, and some drive

The big difference is that the IRS employee selling your data is illegal. So sure, your info can still end up out there in less-legible circles, and some drive by randos can play around with it or perhaps if it's widespread enough your acquaintances could look you up, but the main advanced persistent threat - the surveillance industry - can't really use it. Whereas when you use surveillance based software, since we lack meaningful US privacy legislation, you're assenting to "terms" that allow the surveillance industry to use it for whatever attacks they can implement - eg real time price discrimination, insurance rates, surveillance based authentication, etc.