Do you expect Apple to listen to your conversations just because you use a mac and it has a microphone? Do you expect Toyota to track you everywhere you go because your car came with a GPS system?

Building the system, let alone just making the software, doesn't give you the rights to all the data it produces after you sell it.

Maybe the phone, but not the software running on it.

Most consumers don't realise how little of their phone is purchased and how much of it is licensed, rented or reliant on corporate existence. Imagine if Apple and Google magically disappeared from the universe—the value and utility of your phone will plummet.

Well in germany there is a good sentence about that. 'Ignorance of the law is no excuse'. So basically no matter what you know of anything you won't be guarded by laziness (at least if you are under normal conditions of course).

The question here is what basic privacies can someone expect when they purchase a phone, and how transparent do companies need to be about what information they are collecting.

Yeah but that doesn't mean that they should snap a photo or turn on the mic in my bedroom. The point is that there are limits. Legal and ethical.

Is there a project to replace all of play services with FOSS/encrypted ones?

You can make do (as I do) with LineageOS, F-Droid, and APKMirror. The last is run by the AndroidPolice folks and is therefore trustworthy.