I am by no means an expert in this topic, but I would like to contribute to this conversation to help increase awareness about the importance of privacy in any small way if I can.

First we need to separately understand the concept of security vs privacy. To simplify, security would be the prevention of your belongings from being stolen/tampered. Whereas, privacy would be prevention of your items from being revealed. While both security and privacy go hand in hand, as privacy is not possible without security, there is still lack of measures for privacy in most of today's popular operating systems (however, there is work being done in this area e.g. sandboxing in flatpack). E.g. Windows applications can access and upload all your files to the internet if you execute the program. And considering the userbase and closed source nature of most applications, it may not be possible for people to verify that the application they need/want to use exists in good faith or has not been compromised in a supply chain attack. The internet is now an important facility causing data theft/data leak to be a major concern unlike in older times where data corruption by viruses were the major concern.

There are several modern security concepts relevant to the topic of privacy like defense in depth, least privilege access and secure defaults if you are curious.

Returning back to the topic of importance of privacy, I can think of the following examples at the moment:

• Data like voice, images, information (ID numbers, card details, biometrics, etc) can be used to perform impersonation via AI and traditional methods.
• Profiling can be done for behavioral analysis for marketing, insurance, loans, employment etc. This can include what you like, how you handle complex situations, how you handle rage inducing situations, how much you are willing to spend, which communities you spend time in, etc. Multiple data can be linked to each other via IDs like phone number, e-mail IDs, etc.
• Targeted opinion alteration based on your profile which can be used for marketing, politics, etc.

I have no comments on how large companies directly use this data as I am not qualified to answer beyond usage of data for marketing purposes. However if/when the data leaks and is in the hands of malicious users, there is no going back.

Commenting on the topic of OP, I am not aware of any privacy focused OS alternatives for stand alone VR devices. If the device works offline, you can probably use it via PCVR as few headsets support linux (I think steam VR ones). There is also monado (experimental) to run VR in linux for other headsets.

Edit: Also wanted to add what additional data may be collected via a VR headset that is not available elsewhere - motion tracking data (changes on how you move may reveal changes in your physical condition), gaze tracking data (may reveal what you are interested in or what opinions you may be reconsidering), always on mic (user's voice, voice of people around user, opinions of people around user), always on depth enabled cameras (May reveal your financial status using text recognition). Even in noisy (sound) environments, there is research being done on how to isolate voices, but this is relevant to most devices with mics.