So thinking through this further, here's my take (IANAL):
Let's assume that there are privacy laws around guests in hotel rooms, and that Disney is violating those laws with this policy. In order for that to cost Disney money, someone would have to care enough to take them to court, and then they would have to prove that Disney's violation of that law either cost them money directly, or that they were so terribly distressed by the whole thing that they should be entitled to "punitive damages". And yes, any damage award might be mitigated, if not outright eliminated, by the terms and conditions of the hotel contract. Practically speaking, such a lawsuit is reasonably unlikely, and any damages resulting from it would be small, in Disney's terms.
On the other side of the coin Disney is clearly concerned about both their legal liability and the impact to their business in the event of a Las Vegas style event. If that did happen, the cost to Disney would be a great deal higher than anything an individual unhappy guest is going to throw at them. Put simply, it seems that they have decided that this is the bigger risk, and the attempt (however ineffective) to protect against that is worth whatever business or legal risk they are taking with respect to privacy laws.
IF privacy laws exist, and if Disney is violating them, then it would likely be possible to challenge in court for an injunction against the security checks. But again, who's going to take that on?
So Disney will do whatever they're going to do, and our options as consumers are limited. But they are a bit better than "don't go" or "stand by and smile while our legal rights are violated". We can at least make our displeasure known to Disney, and if we know our legal rights (and again, to be clear, I do NOT - working on guesses here), they can be an aid in those conversations. And discussions in forums like this help to ensure people hear both sides of the issue, that their concerns are shared and valid, and that they do have options (however limited).