This whataboutism ignores one very important point.
When you connect a device to an American company they might do things that we consider privacy violations, while still staying generally within the bounds of the law. We like to joke about data going to the NSA or something, but in the extremely limited cases where it does protections exist with oversight.
Contrast this to Chinese companies where by law every company is part-owned by the government itself. The Ministry of State Security literally has employees who show up to these companies every day like normal workers, but their job is to find and exploit intelligence on foreign individuals and businesses.