In proprietary soft the risk of privacy flaws is greater in online services, than in local apps, just the other way arround as you said. In FOSS yo can only stay secure selfhosting it, but not all people have the possibility or the money to pay an own server and must trust an more o less stable public server. Well, as VPN you can use Proton, which is Freemium OpenSource, like also some others, but even so, are you sure about the hundreds or thosends of public servers which connect the VPN? As said, don’t use some pink FOSS glasses with “the wonderful FOSS and proprietary soft very bad” Mantra, the awakening of these idealizations can be unpleasant, I know… Ask a dev of the lot of work which must be done, to convert Chromium, which is 100% FOSS, in something private and usable and how many FOSS in GitHub, GitLab and others, are full of APIs from Google, Facebook, Amazon, MS…, all of these are also 100% FOSS. The risk is online, not locally in your PC (malware apart, often also FOSS), outgoing traffic from an app, you can control, outgoing traffic in an online server you can’t.

You make your account in Mozilla.org, you even download FF and some forks from Mozilla.org, you also sync in the servers of Mozilla, what you are testing is the app store and the specific account site, which are only subpages and it’s data are stored in Mozilla.org and from there to Alphabet, as say, to Google. As say, Firefox is a good and private browser itself, but only if you download it from source instead from Mozilla, without an account and sync with own server, if not Google will recieve your account data. That’s the lack when a company depends on external investors and makes a contract with the devil, thereby losing its independence, since the investor can dictate the rules, this was Mozilla’s big mistake. Now they are certainly trying to free themselves from this contract and I sincerely hope that they achieve it next year as they proposed. Depending on surveillance advertising, it is not a good idea, not for the company, especially if it wants to be used in the EU, and even less so for the user. Mozilla deserves to be able to regain its independence from Alphabet (advertising company), which it has lost with this contract with Google.

Vivaldi does not have external investors, precisely to preserve its independence, they have a different business model, based on their own conditions. They use different links and search engines that include by default in the browser when you download it, they pay a commission when used with the Vivaldi browser and the user is free to use them or delete them, if they do not want to use them. Apart from this, they have a Webstore with Merch and, after requests from many users over the years, they now also accept donations, which was not the case before. Now with the inclusion in the automotive versions in Renault, VAG, Polestar and Mercedes will also receive commissions. All this does not commit user data to advertising companies by Vivaldi at all, it only does so if the user uses a search engine that is not private, but this is then their own decision, Vivaldi cannot prevent you from using Facebook, search with Google or Bing.