Not the OP but: IME, in EU, being tough, not vocal, and being threatening legal actions with serious bases works very well, most institutions know they have skeletons in their wardrobe and they do not like to face someone who is not crying but very decided to hit with all legal means, especially if there are also ideological motivations.

Spyware is a very well generally understood terms: someone breach someone else privacy deliberately, witch means complaint, court and uncertain results for those who decide to spy. Surveillance capitalism is ignored by most, but known as evil so once someone talk about that pointing out the finger to a school, not a hyper-giant player, people arise likely. They imaging in their mind a naked child spied via the webcam etc in an instant. While they do normally not understand nothing about ownership and consent on "digital stuff".

Oh, BTW what "realistically happen" have exactly zero meaning: the possibility of doing so on not managed computers means a built-in RCE so big that such products must not be on the market. Remote control of desktops must be deployed on purpose not came pre-installed from factories because anyone can use a pre-installed system in place. If that's true at least in EU, there is room for legal action against the OEM, not only the school.