Of course no country has such an obligation per se. But if your government constantly attacks my infrastructure, why oh why should I even consider paying a penny for your service? Given that many American companies still market to users outside the US, this nevertheless seems to be the overall expectation.