I'm not sure I'm convinced that location doesn't matter at all. The attack routes are different between countries: local culture determines attack surface insid

I'm not sure I'm convinced that location doesn't matter at all. The attack routes are different between countries: local culture determines attack surface inside the company, local law determines attack surface due to the local government. There are probably more factors at play due to technical reasons, like the closeness to internet exchanges and the difficulty to sniff packets in secret by foreign spies. Unless those are uniformly the same everywhere, I don't think your agrument holds.