Your fancy view of the world is not as fancy as you think and your aggressive, disrespectful rhetoric is doing you a disservice.

The measures you've enumerated (EU zones, encryption, etc) are mitigations for working with a potentially compromised vendor and should be done anyway. Not using the vendor is such a blindingly obvious countermeasure that one has to be either unprofessional or have a hidden interest to dismiss out of hand.