It’s a local database that isn’t even synced. It’s as much “surveillance” as .bash_history is.

What it actually is however is hastily slapped together, enabled by default, and secured about as much as any other random system file, so MS doesn’t get a pass here, but they’re not twirling their mustaches like some would believe.