The only way to make sure you are spyware free is to use Linux. I have no idea if previous versions of Windows have spyware as well and I wouldn't be surprised if they had, because everything nowadays has spyware. If you are doing sensitive work and need to stay off the grid and away from government eyes, you would be stupid to use anything other than Linux (or a modified version based on Unix) anyway.
I will have to address your points separately.
The use of Linux does not guarantee that you are spyware free. Ubuntu has quite a bit of spyware installed out of the box. Since v 16.04 the spyware is claimed to be disabled by default, but I am skeptical.
https://www.gnu.org/philosophy/ubuntu-spyware.en.html
http://arstechnica.com/information-...ls-ubuntu-spyware-because-it-tracks-searches/
Unless you are familiar with a few different programming languages and have personally examined each of the approximately 4 million lines of code in the kernel of Linux, and personally compiled the kernel for your machine, you cannot guarantee that the kernel does not have spyware in it.
After addressing the kernel and having compiled it for your use, you then have to do the same for each of the programs that you would use in Linux. These programs, rather than the kernel, are what most people view as Linux.
Windows server, Windows Vista - W10, can be hardend to the point that they are more secure than Linux. The problem is that up until W10, Windows was not hardend out of the box. W10 has spyware and tracking issues.
Linux is not as secure as many think. There are several known security bugs in Linux.
Microsoft had backported much of the W10 spyware to W8.1, 8.0,7, and Vista. These were installed as updates. The commands below address much of the spyware and remove it. There are also commands that remove the nag and W10 update screens. Most of it addresses removing the Microsoft spyware.
Code:
wusa /uninstall /kb:971033 /quiet /norestart
wusa /uninstall /kb:3146449 /quiet /norestart
wusa /uninstall /kb:3139929 /quiet /norestart
wusa /uninstall /kb:3134813 /quiet /norestart
wusa /uninstall /kb:3112336 /quiet /norestart
wusa /uninstall /kb:3083711 /quiet /norestart
wusa /uninstall /kb:3083710 /quiet /norestart
wusa /uninstall /kb:3083325 /quiet /norestart
wusa /uninstall /kb:3083324 /quiet /norestart
wusa /uninstall /kb:3080149 /quiet /norestart
wusa /uninstall /kb:3075853 /quiet /norestart
wusa /uninstall /kb:3075851 /quiet /norestart
wusa /uninstall /kb:3075249 /quiet /norestart
wusa /uninstall /kb:3068708 /quiet /norestart
wusa /uninstall /kb:3065988 /quiet /norestart
wusa /uninstall /kb:3065987 /quiet /norestart
wusa /uninstall /kb:3050267 /quiet /norestart
wusa /uninstall /kb:3050265 /quiet /norestart
wusa /uninstall /kb:3046480 /quiet /norestart
wusa /uninstall /kb:3044374 /quiet /norestart
wusa /uninstall /kb:3035583 /quiet /norestart
wusa /uninstall /kb:3022345 /quiet /norestart
wusa /uninstall /kb:3021917 /quiet /norestart
wusa /uninstall /kb:2990214 /quiet /norestart
wusa /uninstall /kb:2976978 /quiet /norestart
wusa /uninstall /kb:2952664 /quiet /norestart
wusa /uninstall /kb:2902907 /quiet /norestart
In addition to running the above script on occasion, I have had to lock out some Windows directories, locked and removed access to some registry keys, and shut off all updates. Even this does not guarantee security and privacy.
The most secure common (not so common in use) OS is BSD Unix. While OSX is a variant of Mach 3 Unix, OSX also has several security problems.
There is nothing such as perfect security.