It's encrypted in transit, but it has to be decrypted to be meaningful to the end user and that's where they can eavesdrop, the kernel has full access to user memory and all syscalls, no?

>If Microsoft started doing this, it would be a lot of negative attention

They have a proprietary closed source kernel which can be reverse engineered by very few people outside Microsoft, I think putting a little backdoor there would be less noticeable than showing a message box to every user.