The candy crush thing, or more generally the fact that since Windows 8 they preload third-party applications, is a relatively speaking small problem. However, the fact the specific applications that get preinstalled are based on a targeted advertising profile for the user signed into the PC, assuming you sign in with a Microsoft account is a bigger problem. While I'm sure they take every possible effort to make those profiles anonymous the data in aggregate is impossible to anonymize. There is a setting in Windows to disable that data collection, at least for advertising purposes, but it gets toggled back on "accidentally" after some updates.

They also have a number of features, like copilot (the chat bot), previously they had Cortana, that do similar kinds of data extraction. Mostly, in order to actually process the user request, but also to be used to train the model. They store it in an anonymized form, but again, it's impossible to actually do that in practice.

That's just two things that are installed and enabled by default that: collect user data for, what I and many others find to be unwanted purposes, don't give the user the option to disable that data collection (only limit it), and seemingly doesn't even consistently respect the users choice in that matter. That is by definition spyware.

They also place advertising on the desktop for things like OneDrive subscriptions, MS Office, and other paid Microsoft services. Those preinstalled apps I mentioned before are effectively ads for those applications, many of which are paid apps or have paid components to them. That is by definition adware.

Spyware and adware are forms of malware. Which makes Microsoft a malware vendor.