BitLocker is a full disk encryption system. Under the "device encryption" scheme discussed here, the recovery key is stored on Microsoft servers, but the content remains on the physical device.
I assume if a user was to backup their data using one of Microsoft's other services (e.g. OneDrive), that data would be encrypted under a different regime.
The BitLocker arrangement does provide users with some degree of security, in that an adversary would need access both to the physical device and the recovery keys on Microsoft servers to retrieve a user's data.
Don't they explicitly ask you if you want to backup your recovery key to the cloud?
Is it really that hard to read prompts and change the default setting to manage your own key backup?
If checking a single radio button is all it takes to NSA-proof your device, I'd say we are in pretty good shape. What is everyone complaining about?
So basically they fucked up three times: 1. Marketing encryption while it's not safe, 2. Storing accessible backups of your data on their servers and 3. Actively sharing those backups with the NSA.
Out of those, #1 would be an excusable thing that many companies do, #2 is a reason to mistrust them and #3 is a reason never to store anything with Microsoft ever again. It's just not acceptable to take my data, promise me it is encrypted, then lie about it and freely share my data with the NSA whenever they want.