Of course, it can be, but it's so easy to fix by forking that it doesn't matter, unlike with non-free software. AFAIK Pop!_OS based on Ubuntu is not spyware.
Also, Ubuntu is not free software. Only some parts of it are free.
This is a good example. It demonstrates that today the four freedoms may not be sufficient. Of course if you compile it yourself, you can remove the spying, but with the Google's browser it becomes harder and harder with time.
This is not true. Free software is not.