I agree based on a dictionary definition of malicious, but I think people are using it here to mean "things that they know users explicitly don't want and are doing anyway". Having privacy settings and then completely ignoring them might not be malicious - you don't intend to harm your customers, only to increase your profits in some way - but I think that common usage of the word "malicious" would include that case.