Solution: have a broadband router supporting domain filtering
I've added what I think are the relevant spy domains, from the list in BlockWindows on Github, to my router's domain filter, because I don't trust any software solution on a Windows 10 machine to be 100%, including the hosts file.