Maybe! But here's the rub-- a US person has some legal protection against surveillance directly by the US, in the US, but (maybe?) none against Australia, for data processed in country or by Australians. Australia then (maybe?) has no safeguards against sharing their surveillance of US persons back to the US.

It's a legal and bureaucratic not technical puzzle. I wouldn't believe any comfort statement on the point either. This sequence isn't a bug, it's a feature of the Five Eyes configuration.