"someone did compromise SpyFone's back-end systems three years ago"
I'm sorry, but how come this company has been operating for three years? Shouldn't the FTC have shut them down a while ago? OK so this is the USA, which doesn't have GDPR, but surely one has some expectation of privacy?
A pretty good advert for the other evil empire - Apple*
*(Yes, I know, I'm a hypocrite, I have both iMac and iPhone, don't remind me. But what's the choice?)