In proprietary soft the risk of privacy flaws is greater in online services, than in local apps, just the other way arround as you said. In FOSS yo can only stay secure selfhosting it, but not all people have the possibility or the money to pay an own server and must trust an more o less stable public server. Well, as VPN you can use Proton, which is Freemium OpenSource, like also some others, but even so, are you sure about the hundreds or thosends of public servers which connect the VPN? As said, don't use some pink FOSS glasses with "the wonderful FOSS and proprietary soft very bad" Mantra, the awakening of these idealizations can be unpleasant, I know.. Ask a dev of the lot of work which must be done, to convert Chromium, which is 100% FOSS, in something private and usable and how many FOSS in GitHub, GitLab and others, are full of APIs from Google, Facebook, Amazon, MS...., all of these are also 100% FOSS. The risk is online, not locally in your PC (malware apart, often also FOSS), outgoing traffic from an app, you can control, outgoing traffic in an online server you can't.