Citation needed. I remember Ubuntu sneaking in some stuff a couple of years ago[0], but most of the mainstream distros have a clean track record. What are you referring to exactly?
0: https://www.omgubuntu.co.uk/2018/02/ubuntu-data-collection-o...
Companies have tried buying floss software specifically to add spyware, such as audacity.
It’s not a big fraction of what proprietary OS does, but the threat grows steadily each year.