And it states that investigators may only use websites with strict policies around user consent.
The law dictates it must have an opt in policy, so DNA being accessed is from volunteers basically.
It's also worth noting that if they had your DNA there's no need to steal your pizza because that will just provide the same DNA.
It's also discussing a Maryland law where prosecuters there have to apply to use those volunteers and have a certain level of crime to do so. In other states they can access the volunteers with less hoops to jump through. Nobody can access non volunteers.
On the 'turned on by default' statement, that's just untrue. It was never an opt out policy, it started as an open access arrangement then after legal challenges it became an opt in policy. You can look that up.
Now another misconception that I've noticed is what Gedmatch is, you can't submit spit to Gedmatch, it's a site for people who have tested at other sites to upload their DNA file to compare against other users of the site.
ETA - There's also no addresses on Gedmatch, the police would email you and ask for your details. You can submit addresses to Ancestry for example if you want, but there's no requirement to, or for that matter your name, email, etc etc. In cases currently being worked on they have had leads closed because people won't reply to a message.