Oh sure. They could do this. But they don’t.

But there is absolutely no way to verify what they are doing, no fear of getting caught and thus there is no incentive to behave with integrity.

At least state of knowledge is that this: reproducible-builds.org isn’t fully functional and even if it were what HP does on their machines is closed source stuff.

And even if there were companies or organizations that are big enough enforce transparency, like a big multinational or a government, there will be plenty of cases where smaller companies with sensitive data can’t, like doctors offices or independent lawyers.

It is way easier to charge for a “data privacy” subscription tier and then still just not honoring the wording of that, than to actually put in the effort.