Just imagine eye tracking tech in VR headsets. What a trove of data for advertisers! Did the user see may ad? For how long? Etc.

I hadn't imagined that before writing this, but they could do the exact same thing in the real world with AR. Did you spend some time looking at that car? You are interested in cars. Spending some time in the garden? Watching birds? Running? Etc. What's better than an always-on, always-ouside device which you use as a proxy to see things, and request information? MITM TLS (which Google technically does with Chrome) becomes useless if you just have access to the eyes.