Whatever legal requirements might be at play, the fundamental difference is that a US company will comply, whereas a non-cooperative external party would still

Whatever legal requirements might be at play, the fundamental difference is that a US company will comply, whereas a non-cooperative external party would still need to be broken, which is very much non-trivial in the age of strong cryptography, even if you're NSA.