I felt safe ordering my light online for several reasons, one of them being that I ordered it from another state. If my state investigators were looking at mailing lists from hydro shops, they'd be looking at the ones in my state.
Federal cops don't have the resources to go after 600w closet grows, too many people do it. The DEA has already said they spend their resources on large scale ops, people who are growing it for sale.
Let's say you buy your light and put it away for 6 months while you build a closet or something (I did this, also took a small break from growing) How will the cops know whether or not you're growing pot? Informants. They can't bust your door in just for ordering a light. See, it goes like this.... informant provides police with testimony, audio, and possibly pics. Cops then collect corroborating, circumstantial evidence such as power bills, reciepts, etc.
Starting with mailing lists for legal items and people who use a lot of electric when looking for grow ops is extremely inefficient and contrary to how police investigations are conducted. It's like looking for a needle in a haystack and puts law-abiding citizens under police scrutiny, something for which they would get roasted in the court of public opinion. It's just not how it's done.