In general, if something is possible to exploit, some companies will exploit it.
Figuring out which ones do can be difficult-to-impossible, since that information is not usually available to the public, or in many cases even to most employees. Unless a whistleblower steps forward, the best we can do is guess, and take whatever precautions we feel are worthwhile.