Of course I could do that. As a web app developer, I could also sell details about who my users are, what their passwords are (if I didn't salt+hash them), what actions they've taken on my sites, etc. Both would ruin my businesses and be highly unethical, which is why I would never do either.