I agree that exploit is a strong term here, but when you think about the next time someone in your life falls for a TeamViewer tech support scam, it makes a difference whether the scammers are getting ahold of the contents of their screen at the moment, or everything they’ve done since having the computer.

It seems obvious that MS should put Recall data behind more of an access control than “any process that can read files”.