if someone nefarious gets to the point they can read this stuff then they’ll already be able to record your screen, log keystrokes, etc.

The point is, that with Recall, they can do this back in time. A regular keylogger can only see what you do after he was installed. If you realize that your computer was compromised fast enough, then you can react. With Recall, everything you did in the last months is open to the attacker.

GDPR regulation mandates that there is at least informed consent. So MS has to ask users if they want all their data to be uploaded. This includes of course a disable option. But knowing big tech companies, they’ll find a way to make users press that Okay button.