It’s bad publicity. A failure to protect their customer data and people may cancel due to it or evade them in the future. It’s also an opportunity to report on or discuss their other criticisms.

I can’t speak for them; but it still seems like viable and productive activism to me, whether they do direct or indirect [monetary or personal] damage or not.