The problem is the terms “wrong” or “right”. If I tell everyone confidently that https is all you need for a secure, privacy focused site then that is a different kind of wrong to companies that are set up to do experiments.