I think we have no only been underestimating the CCP, but also the inherent dangers of corporate data collection in general. People have a simplistic default "if you're not doing anything wrong, you have nothing to hide" mentality which I think is horribly wrong.
A Chinese agent was able to use Linkedin to target potential sources
https://www.bbc.com/news/world-asia-53544505 Each time Yeo looked at someone's profile it would suggest a new slate of contacts with similar experience that he might be interested in.