This is true. I know of one that doesn’t care but I’d prefer not to out them even though a lot of people surely know already.
But how could a provider find out, if they are one that cares? Well, they could sniff all their network traffic, do some SPI/DPI on it, store those logs, and run automated analysis on them periodically.
Even then, they’re not going to do the job of, say, the RIAA or MPAA for them. So in most cases, the only way a host would find you out on their own is things like high storage usage (maybe), high amounts of commonly-pirated file types, and high usage of certain protocols (like torrent). Outside of that, probably nothing would happen until your host gets a DMCA notice.
AFAIK, web hosting clients here in the US don’t really have any expectation of privacy from their host itself.