How's that any different from, say, Windows updating and backing up the company's code to OneDrive?

Actions speak louder than words. If the company doesn't even supply and require work devices, they don't effectively consider their code to be valuable IP.

Is Microsoft mining their customers' backup files looking for source code to ingest into their model training pipeline?

Of course the company can still consider their code to be valuable IP.