It's got nothing to do with the device, that's simply a fact of life for many people's accounts on any major service including Microsoft, Google, Apple, your bank and other financial institutions or any others that use online accounts.
Let me guess, have you ever played any games using your Microsoft account? That's a very common reason that your account might become a target, since it's also a common way that the account username can be leaked, though simply using the associated email account that receives spam is a common reason as well.
In truth, you're worried about the wrong thing, since unlike Microsoft, many online services simply don't display the unsuccessful attempts to login like the Activity log does. The fact that they're unsuccessful is actually a positive, since whatever security methods you've used have so far provided protection, though it's also a warning that you should be sure you're using at least 2-Step verification and if possible, also add the Microsoft Authenticator app to your smartphone to ensure your account is properly protected.
And that AI Recall feature doesn't work on existing devices, only on the new ARM-based AI models that last I knew were soon to be released, so it doesn't affect you in any way and even if you bought one of those devices (why would you if you don't want AI?), it can be easily turned off.
IOW, you're not learning what truly matters to your security. Spend some time asking questions before doing pointless things like many of those who've lost their Microsoft or other accounts to Russian, Chinese or North Korean nation state or other criminal gangs. I've never seen so many foolish people in my life as those coming here after losing their accounts, simply because they didn't do the things that Microsoft has been trying to get them to do for years, just as they did with me several years ago.
Rob