NSA has your international traffic logged and timestamped. If you're doing nefarious activity from a non-MLAT country's IP, and you're the only one connecting to it from the US, it's a simple matter of parallel construction for domestic law enforcement to pop you.
This is more just putting some circumstantial evidence together. Parallel construction refers to going out and getting evidence a second time, because you don’t want to reveal how you got it the first time. Usually because the first time it was collected was without a warrant, or collected from a sources or via a method you want to keep secret. So the evidence is reconstructed in parallel.
Couldn't that be countered by using two foreign IPs for your VPN, one for your inbound connection and another for your outbound traffic? It would make it more difficult to correlate your US IP with the outbound VPN traffic without extra information.
Ally countries usually have extradition treaties, and have a greater chance of sharing intel.