This is true only because our laws allow such a thing. The 3rd party doctrine is something that should be heavily restricted to encapsulate people's reasonable expectation of privacy for hosted services. The least of which for our industry because as it stands it requires wasteful work to add unnecessary security just to play legal games and hurts our ability to sell products that store people's sensitive data.