it’s partly that people didn’t even think about it rather than didn’t expect it i guess? “what did people expect” implies that they had enough of an understanding of where their data is stored, and put enough thought into it in order to form an expectation of any kind

and that’s before you get to the unintentional tracking in things like like buttons, friends’ data that you have no control over, etc