Well, they could have. Unless you're generating original content. This is the problem if you are sharing nothing something which is not 100% original on block level.

This is just the reason, why sensitive data needs to be encrypted before deduplication.

OFF System is also one interesting approach to this problem: https://en.wikipedia.org/wiki/OFFSystem

These are more or less "funny" work-a-rounds to the actual problem.