Yes, every application has access to everything. The only exception are those weird apps that use the universal framework or whatever that thing is called, those need to ask for permissions. But most of the apps on your PC have full access to everything.
And Windows does collect and upload a lot of personal information and they could easily upload everything on your system. The same of course applies for the apps as well, they have access to everything except privileged folders (those usually don’t contain your personal data, but system files).
There are an infinite number of programs that could do this. Will they? Probably not.
Best thing is to install a trustworthy personal firewall, and block all outbound network access for all processes, and then enable as needed. This won’t stop Windows itself, but it will give you a heads-up if something else is trying to send data somewhere and you can make an informed choice at the time.