I’m not saying nobody has the resources to hack a company. I’m saying few companies have the resources to detect such a sophisticated hack. Therefore my infra is probably safer with, say, Amazon vs my local colo.

You are correct that individuals seeking personal infosec against state actors must be eternally vigilant.