Of course the situation is far better than with proprietary software, but there is plenty of free software that has user hostile privacy violations. For one example (Cura), the only reason the authors fixed the issue is that the GDPR forced them to do so. Most people don't have the skills one would need to discover nor fix these issues.

https://wiki.debian.org/PrivacyIssues https://github.com/Ultimaker/Cura/issues/2810

There is also plenty of free software for mobile phones and hosted user services.

https://wiki.debian.org/Mobile https://wiki.debian.org/FreedomBox/LeavingTheCloud