Garbage software loaded on a corporate laptop is nothing new. That it comes directly from Microsoft instead of a third party security company does not meaningfully move the needle. I have long assumed that a work machine has literal keyloggers.