Presumably because we let them by continuing to use their products. It’s definitely bullshit though - every time I log into a site I managed my dashboard is littered with notification banners. Most are legit notifications (albeit there should be a proper log for that), but the actual ads for plugins are maddening.