A few minor things, but the point is that they don't need to do questionable things yet.
What is concerning is that they do exactly the same thing as Google — building an integrated, highly coupled infrastructure with barely existing interoperability with other products, single login, not using open standards / interfaces (yes, in this regard they're even worse than Google — Google at least allows IMAP/SMTP, CalDav, CardDav etc), and now the last link — the browser.
After enough people get in and that trap closes, that's when they can start doing anything they want. It doesn't mean they will, but they surely can.