And that’s the problem. How do you know they are not a state actor?

I don't care tbh.

The threat I'm protecting against isn't the state reading my emails, it's Spotify (for example, but there are many, many more) refusing to sign me up because my IP is in a different country to my bank account.

Or every single bloody website on the internet ignoring my browser's preferred language settings and serving me content in the language that they think my IP address comes from.