There are laws that govern for what reason a party can hard pull your credit, it is called the FCRA. 15 USC Â§ 1681b - Permissible purposes of consumer reports | LII / Legal Information Institute
It says that only with a permissible purpose can a hard pull be made on your credit, and you have to be notified of the intent to pull credit. There is a path to recourse for a consumer that feels a non permissible purpose was used to obtain a hard pull dataset, it involves written documentation of non permissive use or purpose and a reasonable time frame for the entity to comply. But I doubt most people will do any of this.
I don't personally like companies using a hard pull when not necessary, things like non prepaid utilities, such as cell phone plans, might necessitate a hard pull as they are being asked to extend credit on at least your billing amount, not to mention if you get a phone with the 2 year discounted price.