The difference is that Dropbox is only allowed to access those files I tell it to. If the Dropbox client would start crawling my filesystem for 'password.txt' or 'banking-tan.list' this would be illegal, no matter what clause is written in the EULA.

So you're suggesting that the FlightSim EULA laid out exactly what the installer was doing, and asked permission to exfiltrate your passwords if the registration key didn't match? I very much doubt that, and I'm skeptical it would be legal even if so.

It's unquestionably illegal to do it on the down-low, like FlightSim has done. It's malware, nothing less, nothing more.