The SDK thing is the real story here. Pixels at least show up in network traffic if you bother to look. SDKs run inside your app with whatever permissions you already granted and most teams never audit them past the initial integration. You're trusting a third party's code with your users' data and hoping they play nice.