There's published proof the US government actively will go to the extent of having submarines go to undersea fiber cables to tap into them. They have private lockers in almost all the datacenters in the world, etc. Doesn't matter if it's an American company or not.

There are potholes and drunk drivers on road. It does not matter if you use seatbelt or not.

Yes it does matter is the company is subject to US law or not. There is not 100% security but saying “it does not matter” is manichean and does not reflect reality. Yes the US have a very long arm but it’s all a cost/benefit even for three letter agencies.

Every time they make use of a zero day or a backdoor they run the risk of it being discovered. The harder it is to get a new one, the more they will think twice about using it for mass and low stakes surveillance. A non-US company will be less inclined/forced to cooperate with them, making it harder for them to siphon data out, hence lowering probability.

No one is 100% safe, agreed though. Probabilities and threat models is all we got.

The US government can (and for many years did) tap the phone calls of the German chancellor; I don't think getting to data held by European cloud providers is really a big challenge for them.

Regarding the tech aspect? no. But legally it's always has been challenging. And that's where the difference lies

Unrelated, I think this also happens the other way around.

Meaning this is about EVERY manager being able to say "this is not my fault", not about any actual result? Literally every last one?

Sounds about right ...