Again, they're not uploading all files, they're only uploading suspicious executables, which by their very nature of needing to be fully loaded before they can be executed tend to be fairly small.
> Yes, but I want an audit log of it all. I doubt they'll ever add this [...]
Microsoft already has audit logs to the point where you can even see who's trying to turn off microsoft defender in your organisation and on which devices.
Just remember, they're catering to big businesses who are actually getting attacked on the regular, and big businesses need crazy levels of auditing.
They're going to have more than you can handle.
> so I'm not going to blindly trust Microsoft.
All security is based on trust and nothing about what you've said so far is specific to Microsoft.
So, why not microsoft?
Yes, but I want an audit log of it all. I doubt they'll ever add this, so I'm not going to blindly trust Microsoft. In my case most files are probably not whitelisted anyway. I download some really huge files sometimes, do those get uploaded too? Do they throttle the uploads and if they don't are they just killing my personal network bandwidth? Like there's too many questions that set me off.
I'm happy with my choice.