One is telemetry (collecting and selling data, primarily used for marketing); the other is selling access to your hardware to run malicious code, like, for example, "attack that server", "mine for bitcoin", "try to crack the password", "send these spam emails". The first is legal, with different levels of what can be collected based on where you live (GDPR for the win!); the other illegal and used for crime.