I think it's more incompetence than malice. It's just such a standard thing for engineers to throw analytics tracking in every website/product they build. Although I am surprised not one person realised this might be a bad idea given the sensitive nature of the site.
In Europe, it’s not (and should not be) a “standard” thing.