The line between privacy and security is very blurry. Consider this: if Microsoft exfiltrates your keystrokes, it's a privacy violation, but if a random person does the same thing then it's a security violation. You might say that the random person is more likely to use it against you, but then the car insurance companies mining your driving data absolutely do use it against some customers, but that's generally considered to be a privacy violation rather than a security violation.