If I'm going to have decoys in my transactions, I need to know about them somehow. How does Monero prevent the remote node I'm connected to from feeding me known ring members, effectively ruining that part of Monero's privacy?
This is indeed one of the problems with using a public remote node controlled by someone else. There is some related information in this answer.
For optimal privacy one should use their own node (whether local or remote).