Pre-internet, there would be no doubt that the California courts would have specific personal jurisdiction over a third party who physically entered a Californian’s home by deceptive means to take personal information from the Californian’s files for its own commercial gain. Here, though Shopify’s entry into the state of California is by electronic means, its surreptitious interception of Briskin’s personal identifying information certainly is a relevant contact with the forum state.
Established norms for things like privacy and consent should have carried over into the online space. They didn't, unfortunately - maybe this is because people viewed the Internet as "not real life," but it is now clear that was a huge legal and cultural oversight.