I'm a security person, and I've found vulnerabilities in both fastmail and various core google services (although not gmail).

Fastmail and gmail both have mature bug bounty programs, which mean they will pay out cash to anyone who finds and reports a way to hack them: https://www.fastmail.com/about/bugbounty.html This shows that they are willing to put money behind their claims to security and probably puts them in the top few % of difficult to hack websites above eg windows live mail.

Also, it's a mistake to think a company will be more secure because it's larger. If anything, I'd say it's the opposite; large companies tend to have complex websites with vastly more attack surface.

Of course, every email provider is vulnerable to certain governments.