You're talking about security, but really, none of the privacy questions are about technical security of the product.

"What if you miss a setting?" Then they'll give you article recommendations or send your search query to the search engine you're targeting in the first place. They're really a long way from what you can call a security issue, or sharing personal data with random third parties or data brokers.

if they want to be FOSS or capitalist

I really don't see any basis for this take. It's not about picking one of two extremes, and the most extreme niches in those.

They create FOSS, and look for privacy respecting partnerships and investment so they can keep it going.

They added ToS because they're integrating services, like their synced/backed up browser data and other respectful integration.

That's all a long way from malice, or significant problematic behavior. And you still have more choice than on the other biggest alternatives.

I don't think it is the best we could have, I would like it a bit different too, but the way you make it out to be is way overblown if not wrong.