This is getting OT but "desktop" is increasingly irrelevant.
Desktop in this context also means laptops.
I was including laptops. Computing is moving almost entirely to mobile (including broadly tablets and chromebooks) and the cloud. More mobile devices are sold every year than the installed base of computers, and the former is still growing (the latter not significantly). The cloud runs on Linux almost entirely, although in most cases the end user has no access to that. But at least the operator/provider of the service isn't running a spyware OS. They will often be running in a spyware virtual machine though.
Overall it is a rather bleak picture in Orwellian terms, but it is important not to focus too much on one increasingly narrow segment at the expense of understanding the entire landscape.
I always wonder why a company doesn't cut out a niche as the "Privacy" tech company and offer users a series of tech solutions that are easy to use and Big Brother free. If people are willing to die for liberty, they're probably willing to pay for it too. Seems like privacy solutions require a huge cost in time and proficiency which is not readily available (or available at all to the less tech savvy) the same way a few extra bucks are.
"Easy to use computer that is spy ready VS spending your life learning the ins and outs of computer privacy" seems like a terrible paradigm if your goal is to end the threat of an Orwellian world.
"Easy to use computer that is spy ready VS easy to use computer that is spy free and is updated by the seller for a nominal fee" seems like a paradigm that could work.
FLOSS alone is not enough to provided protection; this is the main reason why the FSF released GPLv3. It is also a critical difference between Android and Chrome OS. While an Android device can be made into a telescreen, a Chromebook cannot. The key difference is the presence of GPL V3 code deep in Chrome OS.
As for cloud services that provide privacy this is possible and exists today. The key technique that is common to privacy respecting cloud services is to encrypt the data on the client side. The service provider simply never sees the data in the clear. Of course this pre-supposes that the client device itself is secure.
Here are some examples:
https://mega.co.nz/ Cloud storage and sharing
https://protonmail.ch/ Secure Email and cloud storage. This company had a very successful Indiegogo campaign over 5x its goal
https://www.senditonthenet.com/ File upload and sharing
There are more starting all the time.
Of course we also have
https://mymonero.com XMR wallet
https://blockchain.info/ XBT wallet
As for secure clients one can of course splurge on the Purism Librem15
https://www.crowdsupply.com/purism/librem-laptop. The crowd sourcing campaign is again well over the target. Fully configured this Libre Laptop can set one back 3300 USD. One can add a blu-ray player, that can only be used to play MPAA blu-ray disks, using the installed OS, by breaking the DRM! It is critical to understand that a computer or device cannot have two masters. It can either protect the privacy of the user and secure the user's XMR or protect the 19th century business models of organizations such as the MPAA
but not both! So there is hope.
Edit:
...
As a rule, that secure company becomes corrupted through force or greed or subversion of some kind, sooner or later.
Not with the zero knowledge on the cloud providers part model of the examples above. In fact the cloud provider could in fact be using Windows Server on Azure and the privacy of the client data is secure, since neither the service provider, Microsoft or Microsoft's spy partners would have access to the client data in the clear.