Those are good points. They are covered in the page cited in the infographic. I like to include all detail within a visualization but then people tell us the graphic is "too busy".

I don't like commercial things in general but I do like the idea of people getting paid for doing research and visualization instead of having to keep shelling them out for free.

True. It can be part of a breach but is rare which is why the share is so small in the DBIR column. It is an incident type that gets a lot of hype despite rarely resulting in data exfiltration.