Comment by bmacho

> deserves the "go ahead, this is open source, threats don't really help here"

Depending on how serious you think the privacy breach is, you can report them on github, do a campaign against them on any website they don't control (HN/reddit/etc), also you can convince other participants of open source to block their software if they detect it (e.g. GNOME blocks binaries of certain hash etc).

If they run a malware/spyware or something that level, open source will make them stop or go irrelevant.