It's safe to assume that stock Windows 11 leaks every single thing you do to Microsoft. That's the point.
In my head, “normal“ CAs used by browsers for example are held to a high standard of digital trust. Whereas trust in the US military as a CA sort of implies blind faith. But I honestly don’t feel that I know enough about TLS to know why I should trust, say, digicert or identrust, more or less than the US military.
Microsoft gets a pass.
On the English speaking internet, TikTok does indeed get a lot of flak.
But on the other internets, Microsoft gets lots of criticism for how the spy on users too, together with all the other big US-based companies.
It receives it on the English speaking internet as well, but nowhere near the level as what can be seen outside of that.
Although they won't give normal users this option, if you wanted the non-spyware version of Windows, you would need to pay a subscription.