Exactly. When you go to provide your information to a website, you need to consider "what are all the possible outcomes of this?" We can't use the reputation of the providers of a service as a proxy and thus have zero information about what to expect. Since you almost never have the source code for the website you're giving your information to, using your logic, just never give your data out. Right?
Maybe if there was a service promised but not rendered, could you place full blame on the developer(s).