I'm no Windows expert, but basically yes, especially if the program has administrator access. There's no file security on Windows, and basically anything you install can grab files, unless they are in a "protected" folder like System32 or Program Files. Then the program needs to be elevated to Administrator to access those files.
My solution to this would be a program called Simplewall which blocks internet access to applications of your choosing. This isn't a comprehensive security solution, but it does protect against basic data harvesting by apps & programs.
Microsoft is a harder problem though. They are constantly bypassing measures I have tried to combat telemetry, and as the makers of the OS itself it's gonna be pretty hard to be 100% protected from them, especially seeing that Windows is proprietary. They can theoretically do whatever they want if they hide it well enough. If this is a problem might as well use Linux because Windows is only getting worse with privacy concerns every day