Say you sign up with a company when their T&C says they won't use your phone number for marketing, but then they change their T&C to state the opposite. Now they have your phone number. Are they bound by the T&C they stated when you signed up? But even if they are, what is a customer's recourse?
I imagine the legal route is: they can change the T&C and you have to agree *if you continue to use their service*. If you do not continue to use their service they don't have your agreement to the new T&C and therefore can't act on it.
I don't know about Paypal, but many TOS include a clause that the TOS may change at any time, and you agree to be bound by future changes (the "Vader clause"). The purpose of this is presumably to avoid having to keep track of which users have agreed to updated terms: even if simply visiting a site constitutes agreement (which most TOS say does) they'd still have to keep track of who's visited the site when. The danger of such an open-ended contract should be obvious (Lando knows), and as far as I know is untested in court.
Legally, it's probably valid, but I can't imagine people signing a mortgage with language in it like "you agree that we can change the terms of this contract at any time in any way without notice to you and you are still bound by them." Somehow people don't give TOS the same weight, they just click whatever button is necessary to allow them to upload bathroom selfies for the whole world to see.