
Microsoft is the company that approved the software to automatically download and run as admin when a specific device is plugged in. The OEM submitted malware and Microsoft approved it. Both are at fault for letting malware download and run on your device.
In the case of vulnerabilities, MS is fully aware of this happening frequently and has announced they want to do something about it, but hasn’t actually done anything about it.
For backups, see if there’s support in rclone. You can set up encryption in rclone (crypt remote) as an overlay to other storage locations.
Once you encrypt your own backups, the privacy of the cloud storage provider doesn’t matter much. The main things to consider are price, storage capacity, and reliability.