My understanding based on actual reports from people is that the companies you speak of did not go to MACSEC, but did start doing host-to-host IPSEC, as well as

My understanding based on actual reports from people is that the companies you speak of did not go to MACSEC, but did start doing host-to-host IPSEC, as well as L1 AES256 encryption (not macsec). Agreed with the balkanization of the clouds/infrastructure.