If I was the US government, I would add some fake but legitimate-looking IDs in such lists, different ones for every airline I send the list to, so I can identify who leaked the list ex post facto, and come down with God's Wrath on any airline that leaked theirs.

But then, I am not a Bond-esque criminal organization bent for world domination.

This is called “seeding” a list and is standard practice for data brokers. But maybe that’s a sign they’re Bond-esque criminal organizations…

Yup - they're the people ACTUALLY selling your data (and often for pennies)