Microsoft has remote control over millions of computers with admin privileges and can install any software and thus make any changes they want. You cannot disable this.
Microsoft owns literally the biggest botnet in the world.
Just because they haven't used it to DDoS or spam doesn't mean it isn't a botnet. Accidentally deleting people's personal files with that one update, or more recently, deleting people's default browser preference at the same time they're pushing giant ads about their browser on your desktop, is an example of overtly visible and negative stuff they've done with this botnet.
Of course, the spying is much worse but people just don't care about the extreme spying they do.