I don’t know the answer to this, which is why I didn’t mention it in the post.
However, I could speculate that these data-broker companies scrape leaked [hacked and stolen] data from various panels and then match records on their end.
kinda OSINT for bad reasons.
It seems that part is completely missing. (Or I missed it.)
So for example can/do airlines sell it? Or telecom/utility companies, when you use their app?