It's illegal only if you have the means to bring a lawsuit forward and reasonably prove this is happening, which is difficult without a full third-party audit of the codebase of the company.