Hysteria or ignorance, as with other items in this list. Safe browsing is designed not to compromise privacy.

Notably, the Safe Browsing Update API never sends the URL itself to the server: it does a local lookup with hash prefixes of the URL, and only if that finds some threat does it then send the hash prefix to Google (which gives some degree of deniability, given they never know what actual URL you've visited, and only rarely get anything).

Maybe I just don't want to send Google any info.

Ha! Says Google, right? Anything that gets sent to them is too much.

Says Mozilla, and the source code is available for anyone to double-check. Google doesn't have control over what data Firefox sends to the safe browsing API.

Let me fix that for you: Google doesn't have direct control...

What other items do you think fall into this category?

For instance, disabling geolocation. You need to explicitly approve geolocation requests anyway. If you're sure you'll never ever want to share your location with a site, sure, disable it globally. But recommending this to others as a way to protect their privacy is a bit silly.

Well, I for one appreciate the recommendation and will follow it to get rid of annoying messages. To each their own.

It blocks legitimate sites, e.g. file-droppers just because someone dropped a malware file there.

Which even if true has nothing to do with privacy...

Because those features can involve uploading your browsing history to 3rd parties... does Microsoft check locally against malicious site lists, or does it upload every address you visit in order to tell you it's safe?

I'm unaware of any anti-malware/phishing tool that uploads every address, because it'd be far too slow (you want to know if it's malicious before you show the user anything, to avoid them having the chance to interact with it). They all have some local partial list that is used for a first match, and only if that matches do they interact with any online service.

MS don't have a publicly documented API, which makes it harder to know what's being sent (short of reverse-engineering it), but Google's never uploads actual addresses (it almost always only uploads the uppermost 32-bits of the SHA256 hash of the address, and it never uploads the full hash).