They can but they will not do that, because it will make the exchanger no longer trusted, it will reduce their income, because people will avoiding its exchanger
Who said they cannot if they have the opportunity to monetize it, they will only do it secretly that no one will know about it. Look at the case of Facebook, how many years did Facebook practiced that before they were exposed, it took lots of years and I am sure that they would not have been exposed if not for their did that got leaked internally.
Many of these people sell the data to make money. for sometimes now, I have been seeing some projects offering to pay people certain amount of money to drop their data and the last one I saw was even from a reputable exchanger and I began to wonder why, until it dawn on me that they are simply going to make a whole hell of money from it, so this shit happens a lot and we cannot trust anyone no matter how clean they look.