The whole point of misusing legitimate purpose is they're trying to end-run around consent. It's a bad hack until one of the national data protection agencies decides to say "no, you can't do that" and then it goes away.