What if they could meet the regulations without it costing too much and without exposing them to risk of compromising privacy and security? I don't see why you find it disappointing that they checked to see if that was the case rather than immediately pulling out.