So, after reading this advice, I decided I'd actually try it out - it's easy enough to download a word list and write a script that pings a WHOIS API to check every single word or word pair. Turns out most such APIs are rate-limited, so I couldn't get as far as I wanted, but in a random spot check of 30 or so words off the word list, every single one of them was taken (as was the word-pair that I'm actually using for my startup). Even things as out-there as absurder.com or tektites.com.
I think it's a good bet that somebody has already done this and registered every single English word and many word pair in the .com TLD.
The good news is that by shitting all over .com, there will be no more startups founded with .com domain names. Either companies will buy them as they get bigger, creating a big transfer of wealth from startups to domain squatters, or more likely they'll just give up and we'll get more .ly, .io, or other gTLD domains in the future.