[marcosdumay]

> Is there any indication that software running on the client is at risk?

Yes, Microsoft shares all of Windows vunerability with the NSA long before fixing them.

> I don't think storing information in the cloud using FOSS software is going to magically protect your information.

And you are right, it won't. Anything you send to 3rd party severs is gone.

To keep data private, you must keep it at your computers, run only audited FOSS that you compiled with a trusted compiler, encrypt it all the times it goes into a network (even your LAN), and hope that there isn't a firmware or hardware backdoor in your computer.