I have installed many surveillance systems but the difference is I fully control them and I know that they can not upload data without going out of my way to make that happen. Local DMZ on separate physical network, Chroot SFTP-Only server, no internet routing, no DNS, etc... push-pull
There's also OpenRecall if you prefer a FOSS solution.
If some form of AI is running locally it can extract summarized information and upload it in a tiny file much like Discord can silently transcribe voice to obfuscated and compressed text in the background for private chats.
Anything that even smells like Recall must be opt in and give people good incentives to install it even before considering the possibility of anything being uploaded. If there isn't anything shady occurring then I should be able to click "Uninstall" in apps and it removes all the code. If I can't single click remove it there is a reason.
Regarding FOSS, whether a tool is open or closed source does not expose the dark patterns that can be implemented by the operator which in this case is not the owner of the laptop or workstation. I can do nefarious things with open source tools, as can Microsoft. They are the administrators of this service running on peoples machines. I can use powershell to upload files from a persons machine, as can Microsoft. Every operating system have all the tools a spy would need built in to gather, obfuscate and upload data silently in the background.
Though they acquired github (to be nice) and fed all the GPL'ed code they could find into LLMs (to be nice) and now open source is moribund, which is rather in keeping with the effect of previous strategic moves, but sort of plausibly deniable as an aggregate effect.
That said the feature still seems kinda dumb to me and feels very much like a solution in search of a problem. There is a ton of data on a device which doesn’t require screen shotting everything. Want to help the user find some website they visited long ago? Just parse every web page the user visits and summarize it no screen shot necessary
That's not a solution, though. If I use Obsidian to store sensitive information about my business, does Obsidian need to know that the information is sensitive and to tell Windows not to look at it? How would it possibly know?
Fundamentally the user is the one who knows, and telling the OS whether every last thing is safe to index or not it's simply a non starter. Hell, even trusting the user to reliably and accurately tell you what is actually sensitive or not isn't going to work either.