This never happened and got wrongfully advertised and echo chambered in the media by people who are clearly no experts. I posted the whole thing in my hardening guide.

You find the hardening guidance on the right-side on the sidebar. They could have reviewed the commit more and explain it with an article, this is why people misinterpreted it and that is why the CEO had to apologize. There was no privacy harm or making millions.

Story is here, read the code.

This is why mass media is toxic, it spread misinformation - very often - without actually inspecting the code, asking people who were involved into it etc.

replacing the content of http headers,

Not entirely sure but this is a privacy feature to strip down trackers. See “Debouncing” to Defeat Bounce Tracking. This also got several times requested in the forums. uBlock among other extension do the same these days.